Professional Documents
Culture Documents
Sam Admin Guide
Sam Admin Guide
Sam Admin Guide
No part of this document may be reproduced by any means nor modified, decompiled, disassembled, published
or distributed, in whole or in part, or translated to any electronic medium or other means without the written
consent of SolarWinds. All right, title, and interest in and to the software and documentation are and shall remain
the exclusive property of SolarWinds and its respective licensors.
SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR
IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED
HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN,
MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO
EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES,
WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS
HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
The SOLARWINDS and SOLARWINDS & Design marks are the exclusive property of SolarWinds Worldwide,
LLC and its affiliates, are registered with the U.S. Patent and Trademark Office, and may be registered or
pending registration in other countries. All other SolarWinds trademarks, service marks, and logos may be
common law marks, registered or pending registration in the United States or in other countries. All other
trademarks mentioned herein are used for identification purposes only and may be or are trademarks or
registered trademarks of their respective companies.
Portions Copyright ComponentOne, LLC 1991-2002. All Rights Reserved.
Portions of the following SolarWinds SAM Documentation is excerpted from:
IBM DeveloperWorks, Copyright IBM Corporation 1994, 2012.Available at
http://www.ibm.com/developerworks/
Microsoft TechNet, TechNet Library, 2010 Microsoft Corporation.All rights reserved.Available at
technet.microsoft.com.
Oracle Corporation, 2012 2010 Oracle Corporation. All rights reserved.Available at www.oracle.com
Portions of the component monitor information used in the AppInsight for SQL feature are provided courtesy of
the following sources:
http://technet.microsoft.com/en-us/library/ms190382.aspx
http://sql-articles.com/articles/performance-tunning/performance-counters/
http://linuxtechres.blogspot.com/2012/07/how-to-monitor-and-tune-microsoft-sql.html
http://blogs.msdn.com/b/askjay/archive/2011/07/08/troubleshooting-slow-disk-i-o-in-sql-server.aspx
http://www.grumpyolddba.co.uk/monitoring/Performance%20Counter%20Guidance%20-%20Windows%20Ser
ver.htm
http://www.quest.com/backstage/images/promotions/SQLServer-Perfmonance-Poster.pdf
http://sqlmag.com/t-sql/opening-microsofts-performance-tuning-toolbox
http://msdn.microsoft.com/en-us/library/dd672789(v=sql.100).aspx
http://sqlserverplanet.com/optimization/performance-counters
http://rds.blog.alibabainc.com/?tag=mssql-%E6%80%A7%E8%83%BD%E8%AE%A1%E6%95%B0%E5%99%A8
http://publib.boulder.ibm.com/tividd/td/ITMD/SC23-4852-00/en_US/HTML/mssql511rg02.htm#wq1
http://www.sql-server-performance.com/2005/hardware-bottlenecks/
http://blogs.msdn.com/b/teekamg/archive/2007/11/06/sql-server-memory-related-performance-counters.aspx
http://programming4.us/database/3424.aspx
http://www.informit.com/guides/content.aspx?g=sqlserver&seqNum=262
http://blogs.msdn.com/b/rafidl/archive/2010/06/07/check-if-you-have-sql-memory-pressure-using-perfmon.aspx
http://sqlserverplanet.com/dba/understanding-batch-requests-sec
http://www.databasejournal.com/features/mssql/article.php/3932406/Top-10-SQL-Server-Counters-for-MonitoringSQL-Server-Performance.htm
Portions of the following SolarWinds SAM Documentation is excerpted from:
Microsoft TechNet, TechNet Library, 2010 Microsoft Corporation. All rights reserved.
Available at technet.microsoft.com
http://msdn.microsoft.com.
http://www.docstoc.com/docs/69756322/Performance-Counters-for-Microsoft-Products
http://support.microsoft.com/kb/968930.
http://powershell.com/cs/media/p/9869.aspx.
http://www.cs.cf.ac.uk/Dave/PERL/node174.html
http://msdn.microsoft.com/en-us/library/ee694763.aspx
http://technet.microsoft.com/en-us/library/ff823816.aspx
http://technet.microsoft.com/en-us/library/bb794879.aspx
http://technet.microsoft.com/en-us/library/gg670897.aspx
http://technet.microsoft.com/en-us/library/cc773676%28v=ws.10%29.aspx
http://technet.microsoft.com/en-us/library/bb691338.aspx
http://technet.microsoft.com/en-us/library/bb201689%28EXCHG.80%29.aspx
http://technet.microsoft.com/en-us/library/9tyc2s04(v=VS.80).aspx.
http://technet.microsoft.com/en-us/library/9tyc2s04(v=VS.80).aspx.
http://www.docstoc.com/docs/69756322/Performance-Counters-for-Microsoft-Products.
http://msdn.microsoft.com/en-us/library/cc773514%28v=ws.10%29.aspx.
http://technet.microsoft.com/en-us/library/ff367892.aspx.
http://msdn.microsoft.com/en-us/library/ms804612.aspx.
http://technet.microsoft.com/en-us/library/cc727402%28v=ws.10%29.aspx
http://technet.microsoft.com/en-us/library/cc726402%28v=ws.10%29.aspx
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/0a6c9f07-a70c-4c3d-b93d5dfef593c744.mspx?mfr=true
http://msdn.microsoft.com/en-us/library/ee558869.aspx, http://msdn.microsoft.com/en-us/library/aa979484.aspx,
http://msdn.microsoft.com/en-us/library/aa979484%28v=office.12%29.aspx
http://www.saunalahti.fi/pesonpa/projects/exchange_server_2003/exchange_2003.php
http://technet.microsoft.com/en-us/library/cc754806%28v=ws.10%29.aspx.
http://msdn.microsoft.com/en-us/library/ee254010(v=bts.10).aspx.
http://technet.microsoft.com/en-us/library/gg670897(v=ocs.14).aspx .
http://technet.microsoft.com/en-us/library/gg670897(v=ocs.14).aspx .
http://msdn.microsoft.com/en-us/library/aa979484
(v=office.14).aspxhttp://www.webperformance.com/support/suite/manual50/Content/Load_Test_Statistics.htm
http://www.techrepublic.com/article/solutionbase-working-with-microsoft-windows-server-2003s-performancemonitor/5298961.
IBM Corporation, Copyright 2012 IBM Corporation. All rights reserved. Available at http://www.ibm.com
http://www.ibm.com/developerworks/
http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.ibm.aix.cmds/doc/aixcmds6/vmstat.ht
m
http://www.scribd.com/No%20Starch%20Press/d/15737972-The-Book-of-Postfix-StateoftheArt-MessageTransport
http://www.linuxjournal.com/article/9454
http://www.informix.com.ua/articles/monitor/monitor.htm
http://www.ibm.com/developerworks/data/zones/informix/library/techarticle/0303fan/0303fan.html
http://ipmsupport.solarwinds.com/mibs_byoidtree.aspx?oid=1.3.6.1.4.1.334.72.1.1.10.17#h.
Portions of this document were originally created by and are excerpted from the following sources:
Oracle Corporation, 2012 2010 Oracle Corporation. All rights reserved.Available at www.oracle.com
http://docs.oracle.com/cd/E19623-01/820-6173/def-unbind-operation.htm
http://gurudatta-solaris.blogspot.com/2009/12/solaris-notes.html
http://dev.mysql.com/doc/refman/5.0/en/server-status-variables.html
http://download.oracle.com/docs
http://www.postgresql.org/docs/9.1/interactive/index.html
http://docs.oracle.com/javase/1.5.0/docs/api/java/lang/management/package-summary.html.
http://docs.redhat.com/docs/en-US/JBoss_Operations_Network/2.2/html/Managed_Resources_
Guide/JBossAS_Server.html.
Dirk Nachbar: Oracle Fusion Middleware & Application Server, Copyright 2015
http://dirknachbar.blogspot.com/2011/02/percentage-used-of-tablespaces.html
Symantec Corporation, Copyright 2012, Symantec Inc. All rights reserved. Available at
http://www.symantec.com/business/support/index?page=content&id=TECH23710.
http://www.symantec.com/business/support/index?page=content&id=TECH102748
Citrix Corporation, Citrix InfoCenter, Copyright 2012 Citrix Corporation. All rights reserved. Available at
http://support.citrix.com/proddocs/topic/infocenter/ic-how-to-use.html
RealNetworks, Inc., Helix Server and Helix Proxy Troubleshooting Guide, Copyright 2012 RealNetworks,
Inc. All rights reserved. Available at
http://www.google.com/url?sa=t&rct=j&q=%22a%20mutex%20collision%20occurs%20when%20one%20serv
er%20process%20must%20wait%20for%20another%20%22&source=web&cd=4&ved=0CDoQFjAD&url=http
%3A%2F%2Fservice.jp.real.com%2Fhelp%2Flibrary%2Fguides%2FHelixServerWireline12%2Fpdf%2FServer
ProxyTroubleshoot.pdf&ei=uyqQT9_XE6ie2wXPo5iSBQ&usg=AFQjCNE3CpUHuLmpfScz2A9GOM9ysztgA&cad=rja.
Hewlett-Packard Company, Copyright 2012 Hewlett-Packard Company. All rights reserved. Available at
http://www.hp.com
http://gurudatta-solaris.blogspot.com/2009/12/solaris-notes.html
Portions of the Microsoft Windows Server 2008 R2-2012 R2 Failover Cluster documents are based on the
following source:
http://technet.microsoft.com/en-us/library/ee461009.aspx.
Internet Systems Consortium, Copyright 2012 Internet Systems Consortium. All rights reserved. Available at
http://www.isc.org
http://www.isc.org/software/dhcp
Portions of the Microsoft Routing and Remote Access 2008-2012 R2 and Microsoft Routing and Remote Access
2008-2012 R2 (Events) document are based on the following content:
http://tech-nic.is-a-geek.org/eventid-windows-2008r2/routing-and-remote-access-service-infrastructure/.
Portions of the Remote Desktop Services Licensing document were originally created by and are excerpted from
the following sources:
Microsoft Corp., Copyright 2012. All rights reserved. Available at http://www.microsoft.com/enus/download/details.aspx?id=17657
Portions of the Barracuda Spam and Virus Firewall document is based on the following:
http://techlib.barracuda.com/display/BSFv51/How+to+Use+SNMP+Monitoring.
Portions of the Trend Micro documents are based on the following:
http://downloadcenter.trendmicro.com/index.php?regs=NABU&clk=latest&clkval=3802&lang_loc=1
http://docs.trendmicro.com/all/ent/officescan/v10.6/en-us/osce_10.6_sp2_ag.pdf
Portions of the SQL Server 2008 Reporting Services document, the SQL Server 2008 Reporting Services R2
document, the SQLServer 2012 reporting Services document, and the SQLServer 2008-2012 Reporting Services
(Events) document are based on the following sources:
http://technet.microsoft.com/en-us/library/ms165307(v=sql.100).aspx
http://technet.microsoft.com/en-us/library/cc627471(v=sql.110).aspx
http://technet.microsoft.com/en-us/library/ms159650.aspx
Danga Interactive, Copyright 2012 Danga Interactive. All rights reserved. Available at
http://www.php.net/manual/en/book.memcache.php.
MongoDB, Copyright 2012 10gen, Inc. All rights reserved. Available at
http://www.mongodb.org/display/DOCS/serverStatus+Command.
O'Reilly Squid, Copyright 2012 O'Reilly Media, Inc. All rights reserved. Available at
http://www.scribd.com/sivatcs/d/77305197-O-Reilly-Squid-the-Definitive-Guide.
Sybase, Copyright 2012 Sybase, Inc. All rights reserved. Available at http://www.sypron.nl/mda.html,
http://infocenter.sybase.com/help/index.jsp?topic=/com.sybase.help.ase_15.0.sag1/html/sag1/sag1462.htm,
http://infocenter.sybase.com/help/index.jsp?topic=/com.sybase.dc20022_1251/html/monitoring/monitoring33.htm.
SAP Corporation, Copyright 2012 SAP Corporation. All rights reserved. Available at
http://dcx.sybase.com/1101/en/dbadmin_en11/server-properties-perfapp.html and
http://dcx.sybase.com/1200/en/dbadmin/database-properties-perfapp.html#connpoolcachedcount-db-prop.
APC powerchute, Copyright 2012. All rights reserved. Available at
http://danielthechskid.home.mchsi.com/appa6.htm.
Oracle Corporation, Copyright 2012 Oracle Corporation. All rights reserved. Available at
http://docs.oracle.com/javase/1.5.0/docs/guide/management/overview.html and
http://docs.jboss.org/jbossas/docs/Server_Configuration_Guide/4/html/Additional_Services-Memory_and_Thread_
Monitoring.html.
http://docs.oracle.com/javase/1.5.0/docs/guide/management/overview.html.
TrendMicro, Copyright 2012. All rights reserved. Available at
http://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=0CF4QFjAA&url=http%3A%2F%2F
www.uv.es%2Fdistrisoft%2Fantivirus%2Fcas%2Fman_01_spnt_58_1060_
en.pdf&ei=tw4cUOeJKqrY2QXCgIGgDw&usg=AFQjCNGocyArGtBrtOWmt29IlqGYCQhxQQ
Server Manager for JD Edwards EnterpriseOne. Copyright 2012 JD Edwards Corporation. All rights reserved.
Available at http://servermanager.blogspot.com/2008/01/server-manager-logging-part-3.html;
IBM, Copyright 2012. All rights reserved. Available at
http://publib.boulder.ibm.com/infocenter/db2luw/v9/index.jsp?topic=/com.ibm.db2.udb.admin.doc/doc/r0011478.ht
m.
Bind 9 Administrator Reference Manual: http://ftp.isc.org/isc/bind9/cur/9.9/doc/arm/Bv9ARM.html.
Microsoft TechNet, TechNet Library, 2010 Microsoft Corporation. All rights reserved.Available at
http://technet.microsoft.com/en-us/library/bb490957.aspx
Unidata, Rocket software, 2010 Unidata. All rights reserved.Available at
http://www.rocketsoftware.com/u2/resources/technical-resources/unidata
Portions of this documentation are based on:
http://www.veeam.com/kb1518
http://forums.veeam.com/viewtopic.php?f=2&t=13559
Veeam Backup & Replication PowerShell Guide.
Portions of this document were originally created by and are excerpted from the following sources:
SAAS Corporation, Copyright 2012 SAAS Corporation. All rights reserved. Available at:
http://www.ssas-info.com/analysis-services-articles/58-ssas-2008/1113-analysis-services-2008-performance-
counters,
http://allcomputers.us/windows_server/microsoft-sql-server-2008-analysis-services---monitoring-usage.aspx,
http://allcomputers.us/windows_server/Microsoft-SQL-Server-2008-Analysis-Services---Monitoring-queryperformance.aspx,
http://www.grumpyolddba.co.uk/monitoring/Performance%20Counter%20Guidance%20-%20SSAS.htm,
http://allcomputers.us/windows_server/Microsoft-SQL-Server-2008-Analysis-Services---Monitoring-processingperformance.aspx
http://msdn.microsoft.com/en-us/library/hh230807.aspx
http://www.ssas-info.com/analysis-services-articles/58-ssas-2008/1113-analysis-services-2008-performancecounters,
http://allcomputers.us/windows_server/microsoft-sql-server-2008-analysis-services---monitoring-usage.aspx,
http://allcomputers.us/windows_server/Microsoft-SQL-Server-2008-Analysis-Services---Monitoring-queryperformance.aspx,
http://www.grumpyolddba.co.uk/monitoring/Performance%20Counter%20Guidance%20-%20SSAS.htm,
http://allcomputers.us/windows_server/Microsoft-SQL-Server-2008-Analysis-Services---Monitoring-processingperformance.aspxhttp://www.ssas-info.com/analysis-services-articles/58-ssas-2008/1113-analysis-services2008-performance-counters,
http://allcomputers.us/windows_server/microsoft-sql-server-2008-analysis-services---monitoring-usage.aspx,
http://allcomputers.us/windows_server/Microsoft-SQL-Server-2008-Analysis-Services---Monitoring-queryperformance.aspx,
http://www.grumpyolddba.co.uk/monitoring/Performance%20Counter%20Guidance%20-%20SSAS.htm,
http://allcomputers.us/windows_server/Microsoft-SQL-Server-2008-Analysis-Services---Monitoring-processingperformance.aspx
MSIISSMTPServer document are based on: http://msdn.microsoft.com/en-us/library/ms804618.aspx.
Microsoft copyright 2013
BizTalk Server 2010-2013 is based on the following sources:
http://msdn.microsoft.com/en-us/library/aa559591(v=bts.70).aspx;
http://msdn.microsoft.com/en-us/library/aa559893(v=bts.20).aspx.
http://msdn.microsoft.com/en-us/library/ee254010(v=bts.10).aspx.
http://www.microsoft.com/biztalk/en/us/orchestration.aspx;
http://msdn.microsoft.com/en-us/library/dd800372.aspx.
V-Server definition courtesy of the following:
https://library.netapp.com/ecmdocs/ECMP1196798/html/GUID-E643017F-041B-4ECC-BEA1E4D80E26A47E.html
Portions of the Exchange Active Sync Connectivity document are provided courtesy of the following sources:
Test-ActiveSyncConnectivity:
http://technet.microsoft.com/en-us/library/bb123540(v=exchg.150).aspx
Exchange 2013 templates are based on the following documents:
http://technet.microsoft.com/en-us/library/ff367877.aspx.
http://technet.microsoft.com/en-us/library/ff367871.aspx
Portions of the Clam AV document is based on the following information:
http://exchange.nagios.org/directory/Plugins/Anti-2DVirus/ClamAV/ClamAV-check-plugin/details.
Portions of the Websense document are courtesy of Websense, copyright 2013.
http://www.websense.com/content/support/library/shared/v75/wsga_getting_started/wws_install.aspx
http://www.websense.com/support/article/t-kbarticle/Websense-Web-Security-default-ports
Portions of the Blackberry Enterprise Server 10 Services (Windows) document are based on information found
at:
http://us.blackberry.com/business/software/bes-10.html
Portions of the Blackberry Enterprise Server 10 Statistic (SNMP) document are based on information found at:
http://us.blackberry.com/business/software/bes-10.html
Portions of the Microsoft DirectAccess documents are based on:
http://technet.microsoft.com/en-us/library/hh918442.aspx Microsoft, copyright 2013.
Potions the Oracle documents are based on the following and courtesy of Oracle, copyright 2013:
http://docs.oracle.com/cd/B12037_01/server.101/b10755/dynviews_1019.htm
http://docs.oracle.com/cd/B19306_01/server.102/b14237/dynviews_1019.htm
Portions of the Microsoft System Center Operations Manager 2012 document are courtesy of Microsoft Corp.
Copyright 2013.
http://msdn.microsoft.com/en-us/library/cc146632.aspx
http://technet.microsoft.com/en-us/library/bb932169.aspx
Portions of the AppInsight for IIS document are courtesy of Microsoft Corp. Copyright 2013.
http://technet.microsoft.com/en-us/library/bb742410.aspx
http://msdn.microsoft.com/en-us/library/ms972959.aspx
Portions of this document are courtesy of Kaspersky, copyright 2013:
http://support.kaspersky.com/9297
SolarWinds Server & Application Monitor, 2/24/2015, version 6.2
DJR
About SolarWinds
SolarWinds, Inc develops and markets an array of IT management, monitoring, and
discovery tools to meet the diverse requirements of todays IT management and consulting
professionals. SolarWinds products continue to set benchmarks for quality and
performance and have positioned the company as the leader in IT management and
discovery technology. The SolarWinds customer base includes over 85 percent of the
Fortune 500 and customers from over 170 countries. Our global business partner
distributor network exceeds 100 distributors and resellers.
Contacting SolarWinds
You can contact SolarWinds in a number of ways, including the following:
Team
Contact Information
Sales
1.866.530.8100
http://www.solarwinds.com
Conventions
The documentation uses consistent conventions to help you identify items throughout the
printed and online library.
Convention
Specifying
Bold
Italics
Fixed font
Straight brackets, as in
[value]
Curly braces, as in
{value}
Logical OR, as in
value1|value2
Purpose
Administrator Guide
Evaluation Guide
Page Help
Release Notes
The following documents supplement the Server & Application Monitor documentation library
with information about SolarWinds Common Components:
Document
Purpose
Orion Common
Components
Administrator Guide
Orion Common
Provides help for every window in the Orion Common
Components Page Help Components user interface.
Release Notes
Note: With this release, Orion products are based on a set of common features that are
shared by all of the Orion products. Therefore you need to consult the documentation listed
above for the Orion Common Components in order to find information about all of the
common features.
Table of Contents
About SolarWinds
Contacting SolarWinds
Conventions
Table of Contents
10
Chapter 1: Introduction
85
85
Applications Defined
86
Template/Application Relationship
86
87
89
91
93
93
93
95
96
97
99
FIPS Support
FIPS Manager
99
100
Server Sizing
101
102
102
102
105
109
110
Upgrading SAM to a New Server While Keeping NPM on Your Current Server
110
111
General Requirements
111
Database Requirements
112
112
112
113
113
114
114
115
115
116
116
117
117
118
118
120
120
121
121
122
122
122
122
123
123
125
Uninstalling SAM
130
131
137
137
137
138
138
139
139
139
141
141
141
142
142
142
Licensing
142
146
148
148
149
149
150
150
151
152
152
153
153
153
154
154
156
156
To create a new Application Monitor using the browsing method to select the
desired VMware performance counters:
156
159
159
161
161
163
164
165
Refer to the sections that follow for details about the administrative commands
available in each category:
166
Discovery Central
167
167
Virtualization Settings
Accounts
Account List
Customize
168
168
168
169
169
Color Scheme
169
External Websites
169
169
Manage Alerts
170
Views
170
Manage Views
171
171
171
171
Settings
171
171
Polling Settings
172
SAM Settings
172
SolarWinds Thresholds
172
Virtualization Thresholds
172
Details
172
Database Details
172
Polling Engines
173
173
License Details
173
173
173
174
175
175
175
176
176
176
176
179
179
180
180
181
181
182
182
183
184
184
184
185
185
186
186
186
187
188
188
188
188
189
189
189
190
190
190
192
192
Customizing Views
Creating New Views
To create a new view:
Editing Views
192
193
193
194
194
195
196
Copying Views
To copy a view:
Deleting Views
To delete an existing view:
Views by Device Type
196
197
197
197
197
197
197
198
198
198
198
199
199
200
200
200
200
201
201
202
202
202
203
Filtering Nodes
203
203
Grouping Nodes
204
204
205
205
207
207
207
207
207
208
208
208
NOCView
208
Enabling NOC
209
Adding NOCviews
Adding AppStack to a NOC View
209
211
Editing NOCviews
213
Disabling NOCviews
214
215
215
215
216
217
217
217
217
218
218
219
219
219
219
220
220
220
221
221
221
222
222
223
223
223
223
223
224
224
224
224
225
226
226
Suppressing Events
Suppressing Events:
Using Node Filters
To apply a node filter:
226
227
227
227
228
228
229
229
230
230
230
232
234
234
Custom Chart
235
238
238
239
241
Printing Options
241
Chart Titles
241
Time Period
241
Sample Interval
242
Chart Size
242
Font Size
242
242
243
243
Custom Table
244
245
246
246
CPU Load
247
Memory Usage
247
247
247
248
249
249
250
Zooming
250
251
252
252
253
253
255
258
259
259
259
259
Application Monitors
Manage Application Monitors
Application Monitor Templates
260
260
260
Manage Templates
260
260
Component Monitors
260
261
261
261
261
261
SAM Settings
261
Credentials Library
262
262
Database Maintenance
262
262
263
263
License Summary
SAM License Summary
thwack Community
263
263
263
264
264
265
265
266
Virtualization Discovery
266
Application Discovery
266
266
267
273
273
274
275
275
277
277
Select Nodes
277
Select Applications
277
Enter Credentials
278
278
Add UX Monitors
279
279
279
280
280
280
281
281
282
282
282
282
283
283
284
285
286
287
288
288
288
289
290
290
290
291
291
291
291
292
Managing Dependencies
293
Creating a Dependency
293
To create a dependency:
Editing a Dependency
294
295
295
296
296
296
297
297
297
298
299
300
301
302
302
302
304
304
305
306
307
307
308
309
310
310
310
311
311
311
Polling Intervals
311
312
Network
312
312
313
Node Status:
314
314
Calculating a Baseline
314
315
315
316
316
To configure the Response Time Retry Count for your polling engine:
Chapter 12: Virtualization
VMware Monitoring
316
318
318
319
319
319
321
321
321
323
323
324
324
326
326
327
327
327
327
327
Virtualization Summary
To view the Virtualization Summary:
328
328
328
329
329
329
330
330
331
332
332
332
332
To allow WMI traffic through the Windows Firewall on Windows 2008 R2:
333
333
333
333
334
334
335
336
337
339
339
339
340
340
340
341
342
342
342
342
342
343
343
343
344
344
344
345
345
346
346
346
346
347
347
348
348
348
349
349
351
351
352
353
354
354
355
356
357
358
359
359
360
361
361
361
361
362
362
363
363
363
363
364
364
364
364
364
365
365
365
365
365
366
367
367
367
JSON
368
SOAP Monitor
369
Definitions:
369
response time thresholds. This monitor also has the ability to search for the
presence of a string. You can test the SOAP monitor in Edit mode. If the test
poll throws a web exception (indicating that there was a problem on the target)
the response content is extracted and you will be able to view the message to
help identify the issue.
Configuring the SOAP Monitor
369
372
373
374
374
Linux/Unix Scripts
377
Example Scripts
377
377
378
379
Field Descriptions
380
382
382
383
383
384
Example Scripts
384
386
Return Codes
386
Field Descriptions
387
389
389
392
392
392
393
Select Nodes
393
Select Applications
393
Enter Credentials
394
394
Add UX Monitors
394
394
394
395
396
396
396
Managing Templates
397
Creating Templates
398
398
Assign to Node
398
399
399
Multi-Edit Templates
399
Ordering Components
400
Copying Templates
401
401
401
To export a template:
401
402
402
Deleting Templates
403
To delete a template:
403
Tagging Templates
403
To add tags:
404
To remove tags:
404
404
406
410
411
413
413
413
414
Conversion Value
416
418
419
420
HP
420
HP/VMWare
420
Dell/VMWare
420
IBM
420
VMWare
420
420
421
To Enable Asset Inventory data collection via the Add Node Wizard:
421
421
422
423
423
Drivers
424
Firmware
425
425
Hard Drives
426
427
Logical Volumes
427
Memory
428
Network Interfaces
429
429
430
Peripherals
430
431
Processors
431
Removable Media
432
Software Inventory
432
Storage Controllers
433
System Information
433
General
434
Hardware
434
Operating System
435
435
437
Template/Application Relationship
437
438
439
440
440
441
442
442
443
445
445
445
Add a Node
446
447
Setting Properties
448
449
449
450
451
452
454
455
458
459
All Databases
460
Active Alerts
460
Application Availability
461
Zooming
462
Application Details
462
Buffer Manager
463
Cache
466
Connections
469
Disk
472
475
Memory
481
Pages
491
497
Sessions
498
501
SQL Errors
501
502
SQL Server
503
513
514
515
515
516
516
517
Connections
518
Database Availability
520
Zooming
521
Database Details
522
523
524
Log Flushes
525
Storage
529
538
To change the thresholds for the Top Indexes for Database performance
counter:
539
541
542
544
546
547
Transactions
549
553
554
555
557
557
562
563
566
567
568
570
570
571
572
573
WinRM 2.0
575
575
Configuring IIS
577
579
580
580
PowerShell Permissions
583
585
Attachment Extensions
586
587
588
Active Alerts
589
Application Availability
589
Application Details
591
592
595
602
Exchange Server
603
Information Store
608
614
617
618
Mail Database
623
Management
627
Replication
629
633
Storage
636
639
641
643
645
645
645
Database Copies
647
Database Details
651
659
660
Database I/O
661
Database Metrics
665
Events
668
Messages
670
672
672
673
Mailbox Details
673
675
Received Mail
675
Sent Mail
676
677
679
Troubleshooting Permissions
679
682
685
700
701
702
702
703
704
Editing Resources
705
706
710
710
710
714
715
715
717
717
718
718
718
718
720
720
721
721
722
722
724
Active Alerts
725
Application Availability
725
Application Details
727
Application Pools
727
Cache
729
Connections
732
734
736
738
Management
738
740
Sites
741
742
744
Bindings
744
Connections
745
Files
748
750
Management
750
Network I/O
751
Requests
752
Site Availability
755
Site Details
756
757
757
758
760
761
762
763
Management
764
764
767
771
772
774
775
775
776
777
IISPolling Failed
778
Node Unreachable.
778
IISVersion Failed
779
780
782
783
785
786
787
787
788
790
791
792
793
794
795
796
797
Other Errors
799
803
804
Event IDs
805
814
814
Performance Counters
815
816
History Chart
817
819
819
824
Understanding AppStack
836
837
837
838
Understanding Categories
Understanding the Category Status Summary
840
841
841
841
842
Understanding Layouts
845
847
Navigating AppStack
848
Using AppStack
849
851
853
856
858
859
860
Open Ports Requirements for Remote Deployment from the Orion Server:
860
860
861
Agent Discovery
862
863
866
Deploying an Agent
867
867
871
873
878
888
Agent Settings
890
Managing Agents
892
895
898
899
904
905
907
910
910
912
913
914
914
915
916
916
916
917
917
Agent Alerting
Chapter 18: Alerting and Reporting
Alerting
917
919
919
Understanding Alerts
920
Managing Alerts
921
Managing Actions
922
924
Alert Properties
925
Trigger Conditions
926
Reset Condition
927
Time of Day
928
Trigger Actions
929
Reset Actions
931
Summary
933
Available Alerts
933
Adding Alerts
938
942
942
943
Playing a Sound
944
944
945
945
946
946
947
947
948
948
949
949
950
950
951
951
952
952
953
953
954
954
955
956
956
957
957
957
958
958
959
Management
959
960
961
963
963
964
Alert notes
965
965
966
967
967
968
968
969
969
969
970
970
970
971
974
974
985
1000
1001
1001
Application Reports
1001
Agent Reports
1003
Group Reports
1003
1004
Interface Reports
1005
Node Reports
1007
1012
1014
Report Width:
1014
Header Section:
1015
Logo
1015
Content Section:
1016
Page Layout
1016
Layout Columns
1018
1018
Edit Table
1019
1019
Table Layout
1020
Table Layout
1022
1022
Display Settings
1024
1024
1025
1025
1029
1029
1031
1035
Introduction
1036
Requirements
1036
1037
1037
Port Requirements
1037
User Scenarios
1038
1038
1038
1038
1039
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1051
1052
1053
1055
1055
1056
1057
1057
1057
1058
1059
1059
1060
1060
1061
1062
1063
1064
1064
1065
1065
1066
1066
1067
1068
1069
Top XX Transactions
1070
Traffic By Category
1071
1072
1073
1073
Transactions By Application
1074
Transactions By Node
Chapter 20: Monitoring Hardware Health
1075
1076
1077
1077
1078
1079
1079
1079
Hardware Details
1080
1081
1082
1083
1086
1087
1090
1090
1092
1093
1095
1095
1095
1096
1096
1097
1098
To add a summary view menu item to the menu bar in the Applications tab:
1098
1099
1099
1099
1099
1100
1100
1100
1101
Node Tooltips
1101
Application Tooltips
1102
1102
1102
1103
1103
1103
1104
1104
1104
1105
1105
1106
1108
1109
1110
Volume Size
1111
1112
1112
1113
1114
1116
1116
1117
1118
1119
Percent Utilization
1119
1120
1121
1123
1124
1125
1128
1128
1128
1128
1129
1129
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time 1130
Real Time Process Explorer
Accessing the Real Time Process Explorer
1130
1131
1131
1131
1132
1132
1132
1133
1133
1133
1133
1135
1135
To pause polling:
1135
To end processes:
1135
To start polling:
1136
1136
1136
1139
1139
1139
1140
1140
1140
1141
1141
1142
1143
1143
1144
1146
1147
1148
1148
1149
WTSM Status
1152
1153
1154
1154
1154
1155
Filtering Events
To Select a Log Type:
1155
1155
Reading Events
1157
Monitoring Events
1157
1158
1159
1159
1160
1160
Syslog Resources
1160
1161
1161
1162
1162
1163
1163
1163
1163
1163
1164
1164
1165
1165
1167
1169
1169
1169
1169
1171
1171
Syslog Facilities
1172
Syslog Severities
1173
1175
1175
1175
1176
1176
1176
1176
1177
1177
1177
1177
1178
1178
1179
1181
1181
1182
1184
1184
1185
1185
1185
Restoring a Database
1185
1185
1186
1186
1186
1186
1187
1188
1188
1188
1189
1189
1190
1190
1192
1192
1192
1193
1193
1193
1193
To migrate SAM:
1194
1195
1195
To restore your database backup file on a server running SQL Server 2008: 1196
To update SAM to use a new database:
1197
1198
1198
To export data from one Orion database and import it into another:
1199
1201
1201
1202
1203
1203
1204
1204
1205
1206
1206
1206
1208
1208
1209
1209
1210
1211
1212
1212
1213
1213
1213
1215
1216
Interfaces
1216
Interface Traffic
1217
Interface Errors
1219
1220
Variable Modifiers
1220
1221
1222
Characters
1222
1222
Anchors
1224
Quantifiers
1225
Dot
1227
Word Boundaries
1227
Alternation
1227
1228
1229
General
1229
Date/Time
1230
Group Variables
1231
SQL Query
1233
Status Variables
1234
Node Variables
1235
Volume Variables
1244
1246
Hardware Status
1246
1248
1249
1250
1250
1252
1252
1252
1254
1254
1254
1255
Script Macros
1257
1258
1258
1258
1260
What is in a Map?
1260
Example Maps
1261
1262
1262
1262
1263
1263
1263
1264
1264
1265
1265
1265
1265
1265
1266
1266
1266
1266
1266
1266
1266
1267
1267
1268
Saving Maps
To save a map:
Opening Maps
To open a map:
1268
1268
1269
1269
1269
1269
1270
To display a saved map in the Home view of the SolarWinds Web Console:
Displaying Maps in the SolarWinds EOC Web Console
1270
1270
To display a saved map in the Home view of the SolarWinds EOC web console:1270
Advanced Mapping Techniques
1271
1271
1271
1273
1273
1273
1273
1274
1274
1274
1274
1274
1274
1275
1275
1276
1276
1277
1277
1277
1277
1277
To move a label:
1277
1278
1278
1278
1278
1279
1279
1279
1280
1280
1280
To display a grid:
1280
1281
1281
1281
1282
1283
Map Properties
1283
1283
1283
1283
1284
1284
1284
1285
Application Variables
1285
1286
1287
General Variables
1288
Node Variables
1289
Volume Variables
1295
Wireless Variables
1296
Group Variables
1297
1299
1299
1300
1301
1302
1302
1303
1304
Statistic
1304
Field Descriptions:
1304
1306
Statistic
1307
Field Descriptions:
1307
1308
Statistic
1308
Field Descriptions:
1308
1309
Statistic
1309
Field Descriptions:
1310
1311
1311
1312
Statistic
1312
Field Descriptions:
1312
1313
1314
1315
Statistic
1315
Field Descriptions:
1315
1317
Statistic
1317
Field Descriptions:
1317
1319
Statistic
1319
Field Descriptions:
1319
1320
Statistic
1320
Field Descriptions:
1320
1322
Statistic
1322
Field Descriptions:
1322
1323
1324
Statistic
1324
Field Descriptions:
1324
FTP Monitor
Statistic
1326
1326
Field Descriptions:
1326
1327
Statistic
1327
Troubleshooting
1327
Field Descriptions:
1328
HTTP Monitor
1331
Statistic
1331
Field Descriptions:
1331
HTTPS Monitor
1334
Statistic
1334
Field Descriptions:
1334
IMAP4 Monitor
1338
Statistic
1338
Field Descriptions:
1338
1339
Statistic
1339
Field Descriptions:
1339
JMX Monitor
Field Descriptions:
LDAP User Experience Monitor
1341
1341
1343
Statistic
1343
Field Descriptions:
1343
1345
Statistic
1345
Field Descriptions:
1345
1347
1347
Statistic
1348
Notes:
1348
Field Descriptions:
1348
1350
1350
NNTP Monitor
1352
Statistic
1352
Field Descriptions:
1352
1353
Statistic
1353
1354
TCP Ports
1354
Field Descriptions:
1354
1355
1356
Statistic
1357
1357
TCP Ports
1357
Field Descriptions:
1357
1361
Statistic
1362
Field Descriptions:
1362
POP3 Monitor
1364
Statistic
1365
Field Descriptions:
1365
1366
Statistic
1366
Field Descriptions:
1366
1367
Statistic
1368
Field Descriptions:
1368
1369
Statistic
1369
Field Descriptions:
1369
1371
Statistic
1371
Field Descriptions:
1371
1372
Statistic
1372
Field Descriptions:
1372
SMTP Monitor
1373
Statistic
1374
Field Descriptions:
1374
SNMP Monitor
1375
Statistic
1375
Field Descriptions:
1375
1376
Field Descriptions:
1377
1380
Statistic
1380
Field Descriptions:
1380
1382
1382
1384
Important: This component monitor will not work using an agent as the polling
method.
1384
Statistic
1384
Field Descriptions:
1384
1385
Statistic
1385
Field Descriptions:
1385
1386
Statistic
1386
Field Descriptions:
1387
1389
Statistic
1389
Field Description:
1390
1393
1393
Field Descriptions:
Windows Event Log Monitor
1393
1395
Statistic
1395
Field Descriptions:
1395
1399
Statistic
1399
Field Descriptions:
1399
1401
Field Descriptions:
1402
1404
Statistic
1404
Field Descriptions
1404
WMI Monitor
1405
Statistic
1406
Field Descriptions:
1406
1408
1408
Filter Syntax
SQL or SWQL?
SWQL Filter Syntax Examples
1408
1408
1409
Wildcards
1409
1409
1409
Examples
1409
Filtering by Status
1409
1410
Wildcards
1410
1410
Examples
1410
Filtering by Status
1410
1411
1411
1411
1411
Events Filters
1414
Inventory Filters
1414
EOC Filters
1414
IP SLA Filters
1416
NCM Filters
1418
NTA Filters
1419
Wireless Filters
1419
1420
SysLog Filters
1421
Trap Filters
1421
IVIM Filters
1421
Virtualization Summary
1421
Datacenter Details
1422
Cluster Details
1422
1423
1423
1426
1426
1427
1428
1429
1429
1432
1448
1448
1451
1452
1454
1454
1455
1458
1459
1460
1460
Why does the profile have to be able to log in to the SAM server?
1460
1460
1462
1463
1464
1464
1464
1464
Mailbox recommendations
1465
Advanced Troubleshooting
1465
1465
In SAM v5.0+:
1466
1467
Oracle
1468
1468
Storage
1468
Disk files
1468
1469
1469
Installing ODP.Net
1469
1475
1478
1485
1489
Troubleshooting
1492
1493
1493
Troubleshooting Steps:
1494
Using Process Explorer to Determine if SAM is Loading the Correct Oracle Client Library
1495
Using Process Monitor to Determine Why the Oracle Client Fails
1497
1500
Troubleshooting steps:
1501
1502
1502
1503
1505
PowerShell
PowerShell and SAM: Configuration and Usage
1507
1508
1508
1509
1512
Platform Scenarios
1512
1513
1515
1519
1521
1522
1523
Script:
1523
1524
1524
1524
1524
1525
1526
1527
1527
1527
1535
1537
1538
1541
1545
1547
LDAP
LDAP Key Terms and Components
1550
1550
Distinguished Names
1550
Search Root
1551
Search Filter
1551
1551
1553
1553
1554
1554
Prerequisites
1554
Fields Defined
1554
Credentials
1556
How To...
1558
1558
1560
1560
1560
AppInsight for SQL: Create an alert trigger based on how much available space
is occupied by actual data in the database.
1561
How to Remove an Application Template from Multiple Nodes
1561
1561
1562
1563
1563
1564
1564
1568
Troubleshooting
Slow Performance on Windows Server 2008
To Disable TCP Auto-tuning:
1570
1571
1572
1572
1573
1573
1573
1574
1575
1576
1576
1579
1579
1579
1579
1582
1582
1582
Configure Distributed Component Object Model (DCOM) and User Account Control (UAC)
1582
Enabling DCOM
To enable DCOM permissions for your Server & Application Monitor credentials:
Enabling Account Privileges in WMI
To enable namespace and sub-namespaces privileges:
Disabling Remote User Account Control for Workgroups
To disable remote UAC for a workgroup computer:
1583
1583
1584
1584
1584
1585
1585
1585
1586
1586
1587
1588
1588
1590
1591
Using SNMPWalk.exe:
Troubleshooting a WMI Node
Using Wbemtest.exe to troubleshoot WMI:
Troubleshooting a VMWare Node
To determine if a node is polled through the vCenter or directly:
Troubleshooting AppInsight for Exchange
1592
1593
1593
1595
1596
1597
Troubleshooting Permissions
1597
1600
1603
1618
1620
1620
1621
1622
IISPolling Failed
1622
Node Unreachable.
1623
IISVersion Failed
1624
1625
1627
1628
1630
1631
1632
1632
1633
1635
1636
1637
1638
1639
1640
1641
1642
Other Errors
1644
1648
1649
Event IDs
1650
Troubleshooting Agents
SAM Page Help
1659
1660
1660
1661
1661
1661
1662
1662
1662
1662
1663
1666
1666
1670
1671
1674
1674
1676
1676
1678
1678
1678
1679
Application Availability
1679
Application Details
1679
1680
Application Dependencies
1680
Availability Statistics
1681
1681
1681
1682
Components
1682
1682
1682
1683
1684
1684
1684
1685
1685
Down Applications
1685
1685
No Applications Defined
1685
1685
1686
1686
1687
1687
1688
1688
1689
1689
1689
Component Settings
1689
1690
1690
Application Discovery
1691
1691
1691
1692
1692
Credentials Library
1692
1693
Database Settings
1693
Poller Setting
1693
Licensing Summary
1694
1694
1695
1696
1696
Conversion Value
1696
Customize Chart
1696
1698
Field Descriptions
1698
1699
1703
1703
1703
1705
1705
1706
1707
1707
Component Availability
1708
Component Details
1708
1709
1709
1710
1711
1712
1712
1713
1714
Node Details
1714
Applications
1715
1715
1716
1716
1717
1717
1718
Tags
1718
1718
1718
1719
Importing a Template
1719
1719
1719
1720
Group Details
1720
1720
Virtual Assets
1720
1720
1721
1721
1725
1725
1726
1732
AIX
1737
AIX
Monitored Components:
AIX LPD
Apache
1738
1738
1743
1743
Apache
1744
Apache (Windows)
1747
1748
1749
1749
1752
Bind
1755
1756
1756
1758
1758
Note: All monitors, except SNMP Process Monitor: Named, has the Count statistic as difference option enabled and will show the statistical difference from
the last SAM polling cycle.All monitors except SNMP Process Monitor: Named,
require the following arguments: perl ${SCRIPT} path_to_rndc path_to_
named.statswhere path_to_rndc - This is full path to the rndc command. By
default: /usr/local/sbin/rndc. path_to_named.stats - This is full path to
named.stat file, which is generated by the rndc stats command.
1758
Below is an example using the Scripts Arguments field:perl ${SCRIPT} /usr/local/sbin/rndc /var/named/named.stats
1758
Monitored Components:
1758
BizTalk
BizTalk Server 2010 Adapters Performance Counters
Monitored Components:
BizTalk Server 2010 Host Throttling Performance Counters
1766
1767
1767
1771
Monitored Components:
1771
BizTalk Server 2010 Message Box and Orchestrations Performance Counters 1778
BizTalk Server 2010 Availability Status
1783
1785
Monitored Components
BizTalk Server 2010-2013 Availability Status
This template allows you to check the status of BizTalk statistics: Host
Instances, Orchestrations, Send Ports and Send Port Group by using WMI
queries.
1785
1789
1789
1789
Monitored Components
1789
1791
1791
1797
1798
1802
1803
1803
1805
Monitored Components:
1805
1806
1810
Cisco
1814
Cisco CallManager
1815
1817
Monitored Components:
CiscoWorks LAN Management Solution
Monitored Components:
Citrix
1817
1818
1818
1823
1824
1824
1828
1828
1834
1839
1842
1845
Monitored Components:
1845
1851
1856
Clam AV
1858
CUPS
1860
1862
Directory Size
1863
1864
1872
1873
1873
1873
1875
1876
1876
1876
1878
1880
1884
1887
1889
1892
1899
1902
1905
1907
1912
1916
1920
1922
1923
1925
1931
1935
1936
1940
1942
1943
1960
1960
1960
1963
1963
1963
1968
Files
File Age Monitor
1971
1972
Statistic
1972
Field Descriptions:
1972
1974
Monitored Components:
1974
File Count
1975
1976
Monitored Components:
File Existence Monitor
Monitored Components:
1976
1977
1977
1978
1978
1979
1979
GlassFish (JMX)
1980
1984
Monitored Components
Generic Mail Server
Monitored Components:
Group Policy Object (System and Application Logs)
Monitored Components:
Helix
Helix Universal Media Server (Linux/Unix)
Monitored Components:
Helix Universal Media Server (Windows)
Monitored Components:
HP-UX
Monitored Components:
HTTP
HTTP
Monitored Components:
1984
1988
1988
1989
1989
1993
1994
1994
2005
2005
2016
2016
2019
2021
2021
HTTPS Monitor
2022
2023
Monitored Components:
IBM
2023
2023
IBM DB2
2024
2028
IBM Informix
2031
2047
2050
Monitored Components:
ISC DHCP Server (Linux)
2050
2051
2051
Monitored Components:
2051
2053
JBoss (JMX)
2060
2065
2068
Monitored Components:
2068
2071
Linux
2071
2072
Monitored Components:
2072
2074
Monitored Components:
2074
2077
2077
2080
2080
2081
2083
2083
2086
2087
2088
2091
2094
2098
2098
Memcached
2099
2103
2103
2110
2110
2117
2117
2118
2119
2119
2125
2125
2131
2132
2132
2136
2139
Monitored Components:
Microsoft IIS
Internet Information Services and Counters (IIS)
2139
2144
2145
Monitored Components:
2145
2147
Microsoft Lync
Microsoft Lync Server (Edge Role)
Monitored Components:
Microsoft Lync Server (Front-End Role)
Monitored Components:
Microsoft Lync Server (Mediation Role)
Monitored Components:
Microsoft Lync Server 2013 (Front-End Role)
Monitored Components:
Microsoft Lync Server 2013 (Edge Role)
Monitored Components:
Microsoft Lync Server 2013 (Mediation Role)
2150
2152
2152
2157
2157
2163
2163
2165
2165
2172
2172
2178
Monitored Components:
2178
2179
2180
Monitored Components:
Microsoft Message Queuing Events
Monitored Components
Microsoft Network Policy
Microsoft Network Policy Server Events
Monitored Components:
Microsoft Network Policy Server RADIUS Proxy
Monitored Components:
Microsoft Network Policy Server RADIUS Server
Monitored Components:
Microsoft Routing and Remote Access
2180
2184
2184
2200
2201
2201
2207
2207
2210
2210
2212
2212
2217
Microsoft SharePoint
2219
2220
2223
2226
2228
Monitored Components:
2228
2228
2228
2228
2228
2229
2229
2229
Current Requests
2229
2229
Requests Queued
2229
Requests Rejected
2230
2230
Requests/Sec
2230
2230
2231
2231
2231
2231
2231
2231
2232
2232
Active Threads
2232
Microsoft SQL
SQL Server 2005 Analysis Services
Monitored Components:
SQL Server 2008 Analysis Services
Monitored Components:
SQL Server 2012 Analysis Services
Monitored Components:
SQL Server Query
Monitored Components:
2232
2233
2233
2238
2238
2244
2244
2249
2249
2249
2253
2257
2262
2265
2265
2265
2271
2271
2271
2273
2273
2273
2279
2279
2280
2280
2282
2282
2289
2290
2292
2294
2300
2304
2313
2314
2323
2323
2325
2326
2326
2337
2337
2350
2350
2353
2353
Monitored Components:
2353
2358
2358
2361
2361
Monitored Components
2362
2368
2371
2384
Mongo
2385
MongoDB (Windows)
2386
MongoDB (Linux)
2390
MySQL
2395
2405
Field Descriptions
Novell GroupWise
2405
2408
2409
2415
2418
2424
2426
OpenLDAP
2429
Oracle
2432
2432
2432
2437
2437
2441
2448
2448
2449
2449
PostgreSQL
2453
Progress Database
2456
2457
2457
Monitored Components
2457
2462
2462
Monitored Components:
2462
2466
2473
2473
2474
2475
Solaris
2475
Solaris
2476
Solaris LPD
2481
Monitored Components:
SolarWinds
Orion Server
2481
2482
2483
Monitored Components:
2483
2488
Monitored Components:
2488
2492
2495
2499
2504
Monitored Components
Kiwi Syslog Server
Monitored Components:
Squid
2504
2507
2507
2509
Squid (Windows)
2510
2518
2526
2527
Sybase
2531
Sybase ASE
2532
2536
Symantec
Symantec Backup Exec Server
2539
2541
Monitored Components:
Symantec Backup Exec Remote Agent
2541
2548
Monitored Components:
2548
2550
2555
2557
Monitored Components:
Symantec Endpoint Protection Client
2557
2559
Monitored Components:
2559
2562
2563
Monitored Components
Tomcat Server
Monitored Components:
Trend Micro
2563
2569
2569
2570
2570
2571
2574
Monitored Components:
2574
2577
Monitored Components
2577
Unix
2583
2584
Monitored Components:
2584
2587
2589
Monitored Components:
2589
2592
VMWare
2594
2594
2598
Web Link
2600
2600
2600
Chapter 1:
Introduction
SolarWinds Server & Application Monitor (SolarWinds SAM) allows you to create
and monitor your own custom collection of monitored components, providing an
open field of opportunity to the network engineer. It also allows you to create
flexible Application Monitor templates to combine process monitors, port
availability, and performance counters, allowing you to assess the status of every
aspect of your application and the health of the application as a whole.
l
l
l
l
l
l
l
l
l
85
Chapter 1: Introduction
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
Applications Defined
An application in SolarWinds SAM is considered a collection of component
monitors housed in a template. A component monitor is defined as a value
returned by a specific process, counter, status, or a value returned by a script.
With this received data, SolarWinds SAM can easily show you a myriad of vital
statistics concerning the health of your system.
Templates provide blueprints for the applications to be monitored. You can
quickly and easily customize numerous templates, using only the component
monitors you need for a specific environment. Take a look at the following
diagram:
Template/Application Relationship
The following illustration explains the Template and Application relationship and
is true for all templates, including AppInsight Aplications.
Here you can see that if you change something at the template level, the
applications based on that template will be affected. Conversely, if you change
something on the application level, only the individual application will be affected.
This inheritance relationship is beneficial if you need to make a great deal of
changes quickly. For example, rather than change one item on 100 applications
that are based on a single template (which requires 100 changes), you can more
86
87
Chapter 1: Introduction
88
89
Chapter 1: Introduction
database. Keeping with the SolarWinds common components infrastructure, there
are no agents installed on your servers and no remote software to maintain. All
calls are made in real time and displayed on a Web Console accessible from any
supported browser.
As a standalone product, SAM's operations can be visualized with the following
flowchart:
90
91
Chapter 1: Introduction
With respect to how an applications availability is calculated over time, SAM
aggregates the availability values to Hourly/Daily tables during database
maintenance, which is how the average is calculated. Availability for component
monitors is calculated in the same way.
92
Chapter 2:
Requirements and Installation
Installing SolarWinds Server & Application Monitor (SolarWinds SAM) is a wizard
driven process. Resource and space requirements are reasonable, and most
deployments do not require hardware updates to your SolarWinds Server.
This chapter discusses:
l
l
l
l
l
l
l
l
l
l
l
l
Requirements
93
Operating
System
Web
Server
IWAM_<hostname>, as
94
Web
Console
Browser
AL150 - AL500
AL700 AL1500
ALX
CPU
Speed
2.4 GHz
Hard Drive 4 GB
10 GB
25 GB
Space
Note: A RAID 1 drive for server operating system, SolarWinds
installation, and tempdb files is recommended. The SolarWinds
installer needs 1GB on the drive where temporary Windows
system or user variables are stored. Per Windows standards, some
common files may need to be installed on the same drive as your
server operating system.
Memory
4 GB
6 GB
8 GB
95
2.4 GHz
Allocated
Hard Drive
Space
4 GB
10 GB
25 GB
Memory
4 GB
Network
Interface
8 GB
96
AL700 AL1500
ALX
CPU Speed
2.4 GHz
Dual Core
3.0 GHz
97
Hard Drive
Space
4 GB
Memory
4 GB
10 GB
25 GB
8 GB
PowerShell
The Configuration Wizard installs the following required x86 components if they
are not found on your Orion database server:
l
l
98
No additional requirements
8+ GB RAM
Important: If you are running Windows Server 2008, you must upgrade to
Windows Server 2008 R2 because SolarWinds SAM does not support Windows
Server 2008 due to known WMI issues.
FIPS Support
FIPS (Federal Information Processing Standard) defines security and
interoperability standards for computers used by the U.S. federal government.
To enable FIPS in the Local Security Policy on Windows:
1. Click Start > Control Panel > System and Security > Administrative Tools,
and then double-click Local Security Policy.
2. Expand the Local Policies category in the left pane, and then click Security
Options.
3. Right-click System Cryptography: Use FIPS compliant algorithms for
encryption, hashing, and signing.
4. In the context menu that is displayed, click Properties.
5. In the Local Security Setting tab, click Enabled and then click OK.
Notes:
l FIPS can also be enabled as part of Group Policy.
l If using the FIPS Manager to enable/disable FIPS, you need to restart your
web browser to apply the new settings.
SolarWinds SAM installations on Windows Server 2008 R2 require a Microsoft
hotfix to realize the FIPS-compatibility features of this release. For more
information about this required Microsoft hotfix, see the article
http://support.microsoft.com/kb/981119. As noted in the KB article, you need to
enable FIPS first before applying the Microsoft hotfix.
99
The FIPS Manager allows you to switch between both Windows and SolarWinds
FIPS compatible mode. (FIPS mode in Windows needs to be disabled manually if
needed).
The following SolarWinds SAM component monitors have passed FIPS testing:
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
100
Server Sizing
l
l
l
l
l
l
l
SNMP Monitor FIPS not supported when SNMP is SNMPv3 and using
MD5.
SQL Server User Experience Monitor
TCP Port Monitor
Tomcat Server Monitor
Web Link Monitor
Windows Event Log Monitor
Windows Script Monitor
Server Sizing
SolarWinds SAM is capable of monitoring networks of any size, ranging from
small corporate LANs to large enterprise and service provider networks. Most
SolarWinds SAM systems perform well on 3.0 GHz systems with 4 GB of RAM
using default polling engine settings. However, when monitoring larger networks,
you should give additional consideration to the hardware used and the system
configuration.
There are three primary variables that affect scalability. The most important
consideration is the number of monitored components. Monitoring more than
1,000 components may require fine tuning for optimal performance. The second
variable to consider is polling frequency. For instance, if you are collecting
statistics more frequently than the default, the system will have to work harder and
system requirements will increase. Finally, the number of simultaneous users
accessing SolarWinds SAM directly impacts system performance.
When planning a SolarWinds SAM installation, there are four main factors to keep
in mind with respect to polling capacity: CPU, memory, number of polling
engines, and polling engine settings. For minimum hardware recommendations,
see Requirements for SolarWinds SAM on page93. For more information about
polling engines, see Additional Polling Engine and Web Console on page 1208.
Installing SolarWinds SAM and SQL Server on different servers is highly
recommended, particularly if you are planning on having more that 1,000
component monitors. This scenario offers several performance advantages as the
SolarWinds SAM server does not perform any database processing and it does
not have to share resources with SQL Server.
If you plan to monitor 10,000 or more components, SolarWinds recommends that
you install additional polling engines on separate servers to help distribute the
work load. For more information about sizing SolarWinds SAM to your network,
contact the SolarWinds sales team or visit www.solarwinds.com. For more
101
102
4. Confirm that Internet Information Services (IIS) is checked, and then click
Details.
103
6. Confirm that World Wide Web Service is checked, and then click OK.
7. Click OK on the Internet Information Services (IIS) window, and then click
OK on the Application Server window.
104
9. Confirm that both Simple Network Management Protocol and WMI SNMP
Provider are checked, and then click OK.
10. Click Next, and then click Finish when the wizard completes.
Note: You may be prompted to install additional components, to provide
your Windows Operating System media, or to restart your computer.
105
4. Click Next to start the Add Roles Wizard, and then check Web Server (IIS).
106
6. Click Next on the Select Server Roles window, and then click Next on the
Web Server (IIS) window.
107
108
12.
13.
14.
15.
109
Upgrading SAM to a New Server While Keeping NPM on Your Current Server
To upgrade SAM to a new server:
1. Back up your current SolarWinds Server.
2. Shutdown SolarWinds NPM and SAM on your current SolarWinds Server.
3. Have your Database Administrator clone your Orion database to a different
name.
Note: To clone your Orion database, use the appropriate version of
Microsoft SQL Server Management Studio for your database. You can
download this from the Microsoft website if it is not already installed.
4. Uninstall SAMfrom your original SolarWinds Server.
a. Use Add or Remove Programs in Control Panel to remove
SolarWinds Server & Application Monitor.
b. The Configuration Wizard should be run automatically as part of the
uninstallation. If it is not, execute it manually by clicking Start> All
Programs> SolarWinds Orion> Configuration andAutoDiscovery> Configuration Wizard.
110
General Requirements
Moving your SolarWinds SAM implementation to a new server requires the
following:
l
Note: Maps and map objects created or edited in SolarWinds Network Atlas are
stored in the Orion database. If the database is successfully migrated, there is no
need to migrate any additional Network Atlas map files.
111
Database Requirements
Ensure that you comply with the following requirements before you attempt to
modify or back up your existing database:
l
SolarWinds SAM version 6.0 and higher requires SQL Server 2008 or
higher.
Install your new database server. The following procedures assume you are
moving your database from one physical server to another and that the management tool (Enterprise Manager, SQL Server Management Studio
Express, or SQL Server Management Studio) is installed on the new database server.
If you want to use a Microsoft SQL Server Express database, recognize that
the database store is limited to 4GB.
Know the sa password to both your existing Orion database server and your
new database server.
Know the credentials to an account with administrator rights on both your
existing Orion database server and your new database server.
Have a maintenance window during which you can safely shutdown your
SolarWinds SAM services. You need to stop data collection to ensure that
your backup file matches your last active database state.
112
113
114
115
116
16.
17.
18.
19.
20. Select Leave the database ready to use by rolling uncommitted transactions(RESTORE WITH RECOVERY), and then click OK.
21. Open and run the configuration wizard to update your SolarWinds SAM
installation.
Note: Due to the nature of security identifiers (SIDs) assigned to SQL
Server 2008 database accounts, SolarWinds recommends that you create
and use a new account for accessing your restored Orion database on the
Database Account window of the SolarWinds Configuration Wizard.
117
6.
7.
8.
9.
10.
11.
your database server to ensure that you are able to properly configure the
Orion database user account.
Click Next.
Select Use an existing database, select or type the Existing Database
name, and then click Next.
If you are prompted to use the existing database, click Yes.
Select Create a new account, and then provide a New Account name.
Notes:
l Creating a new account ensures that SolarWinds SAM has required
access to your migrated database.
l The New Account must be a member of the securityadmin server role.
l The sysadmin role and the sa user account are always members of
securityadmin.
Provide and confirm an account Password.
Click Next to start database configuration, and then click Finish to exit the
Configuration Wizard.
Reassigning Nodes
If a new name is used for the new SolarWindsSAM server, it is added to the
database as a new polling engine. All current nodes remain assigned to the old
polling engine name and must be reassigned to the new polling engine, as
shown in the following procedure.
To reassign items to the new polling engine:
1. Click Start> All Programs> SolarWinds Orion > Advanced Features>
Orion Service Manager.
2. Stop all SolarWinds services.
Notes:
l If you have more than one Polling Engine, you will need to stop each
additional Polling Engine before continuing.
l Do not stop the SQL Service. The SQL Service needs to be running in
order to make the necessary changes to the database.
3. Click File> Exit
4. Click Start> SolarWinds Orion> Database Utilities> Database
Manager.
5. Expand your SQL Server in the tree.
6. Expand the Orion database.
Note: By default, this database is named NetPerfMon.
7. Right-click on the Engines table, and then click Query Table.
8. Click Refresh to display the table entries.
118
10. Replace the value in the ServerName field for the old polling engine with
the server name of the new polling engine. In the previous graphic, the
OLD-SERVER is renamed NEW-SERVER.
Note: It is not necessary to update the IP field. The next time the service is
started, SolarWinds SAM discovers the new IP address, and the IP field is
updated automatically.
11. Delete the newly added engine from the table (EngineID: 2 in this example)
by clicking on the blank area to the left of the row to select it. Right-click anywhere in the selected row, and then click Delete Selected Rows.
119
120
121
122
123
124
125
126
127
11. After files are copied and installed, configuring begins automatically.
128
13. Type Admin in the User Name field, and then click LOGIN.
129
14. The Network Sonar Wizard is displayed. Click Cancel and then confirm that
you want to cancel the network discovery by clicking OK.
Note: The wizard can be used to discover a set of nodes in your network.
You will use it later in this guide.
Uninstalling SAM
The following procedure fully uninstalls SAM and deletes the SAM database.
Notes:
l
This is a general uninstall procedure, and it may differ slightly from version
to version.
This is the recommended procedure when installing daily builds for testing.
130
14. Delete the SolarWinds folder from the Program Files\Common Files folder
on your main volume. Typically, the Common Files folder is located at
C:\Program Files\Common Files\.
15. Delete the SolarWinds website directory. Typically, the SolarWinds website
directory is located in C:\Inetpub\.
16. Delete the SolarWinds folder from the All Users\Application Data\ directory. Typically, this SolarWinds folder is located in C:\Documents and Settings\All Users\Application Data\.
17. Using your SQL Server tools, delete your Orion database. The Orion database is typically named NetPerfMon, and it can be found in the Databases
folder of your SQL Server management application.
18. Using your SQL Server tools, delete your Orion database user. The Orion
database user can be found by expanding Security > Logins in your SQL
Server management application.
131
1. Accept the terms of the license agreement, and then click Next.
132
2. Accept the default install location, or navigate to a different location, and then
click Next.
133
4. SAM will begin installation, taking you through multiple installation screens.
Click Next as prompted to be taken to the Database Settings of the Configuration
Wizard,
134
135
8. Ensure that all the services displayed in the Service Settings page are
checked, and then click Next.
136
9. Review the Configuration wizard Summary page, and then click Next.
10. Click Finish to complete the Configuration Wizard.
Note: If you encounter any issues with the additional polling engine, rerun the
Configuration Wizard on the SolarWinds SAM server.
To assign nodes to polling engines:
You can assign nodes to the polling engines by selecting the desired Polling
Engine in the Add Node wizard.
You can also perform Poller Load Balancing using the Monitor Polling Engines
tool to assign nodes to polling engines. Click Start> All Programs>
SolarWinds> AdvancedFeatures> Monitor Polling Engines. Then click
Servers > Poller Load Balancing to display a dialog where you can assign
nodes to particular polling engines. For more information, see Understanding
How Polling Engines Work" on page 1208.
137
8.
9.
10.
11.
12.
138
139
l
l
140
13.
14.
15.
16.
17.
18.
19.
20.
21.
URL used to access the web console. For example, if you specify an IP
address of 192.168.0.3 and port 8080, the URL used to access the web
console is http://192.168.0.3:8080.
Click Next.
If you are prompted to create a new directory, click Yes.
If you are prompted to create a new website, click Yes.
Note: Choosing to overwrite the existing website will not result in the deletion of any custom SolarWinds SAM website settings you may have previously applied.
Confirm that all services you want to install are checked, and then click
Next.
Review the final configuration items, and then click Next.
Click Next on the Completing the SolarWinds Configuration Wizard dialog.
Click Finish when the SolarWinds Configuration Wizard completes.
Log in to the SolarWinds Web Console as an administrator.
Note: By default, you can log in with User Name Admin and no password.
If you have not discovered your network devices and added them to
the Orion database, the Network Discovery Wizard starts.
141
Content from the website listed below is being blocked by the Internet
Explorer Enhanced Security Configuration.
To add the specified URLs to your trusted sites list, click the Add button
in the Internet Explorer dialog.
For more information about adding sites to your trusted sites list, see the Microsoft
article, Working with Internet Explorer Security Settings.
Licensing
The SolarWinds SAM license you purchase is based on the number of allowed
assigned component monitors. A component monitor provides a statistic that you
want to monitor in SolarWinds SAM. You can have as many application templates
and assigned monitors as you need, as long as the number of assigned
component monitors does not exceed the license count.
If you have more assigned component monitors than allowed by your license, the
monitors that exceed your license limit are not activated, and their component
statuses are changed to "Not Licensed." You can either disable some assigned
component monitors to reduce your total assigned monitor count, or contact
SolarWinds about upgrading your SolarWinds SAM license.
How is SAM
Available License
Questions
142
Answers
Licensing
licensed?
Tiers
By the
number of
Component
Monitors
What is a
Component
Monitor?
The value
returned by a
component
monitor is a
measurement
of application
health and
availability
that needs to
be monitored.
It can be a
process, a
service, a
performance
counter, a
port, an URL,
a User
Experience
Monitor, a
Nagios script,
and so on.
An
application
typically
consumes
15-25
component
monitors.
The
Windows
Scheduled
Task Monitor
consumes
five (5)
component
143
monitors per
Windows
server.
AppInsight
for SQL
consumes 50
component
monitors per
database
instance.
AppInsight
for Exchange
consumes 50
component
monitors per
mailbox role
server.
AppInsight
for IIS
consumes 30
component
monitors per
monitored IIS
server.
Why Component
Monitors, and not
devices?
144
Monitorbased pricing
is flexible.
Monitorbased pricing
provides a
good
correlation of
price to
value.
Licensing
Is it always on
component
monitors?
Technically,
it is based on
highest
number of
Nodes,
Volumes,
and
Component
Monitors
(refer to NPM
licensing for
Node &
Volume
definition),
but in almost
every case,
Component
Monitors is
the highest
factor. There
may be some
instances
where
Volumes or
Nodes would
be the
highest
factor.
145
Note: SolarWinds SAM licenses do not have to mirror the license count of any
other installed SolarWinds product. For example, you can install SolarWinds
SAM with a 150 component license on a SolarWinds NPM server with an
unlimited node license.
To see the available component monitors remaining in your license:
1. Log on to the SolarWinds Web Console with an administrator account.
2. Click Applications.
3. Click SAM Settings.
146
When using your Customer ID and password, you can use your individual
profile information.
You can get your license information from the customer portal using the customer portal link: https://customerportal.solarwinds.com/ instead of support.solarwinds.com
If you do not know your CustomerID and/or password, navigate to
http://www.solarwinds.com/support/ticket/serviceticket.aspx and request the
desired information.
To get your activation key, navigate to the Customer Portal and click
License Management, then click the plus sign [+].
Deactivation
If you have deactivation information, you should step through the deactivation
process a second time. You no longer need your Customer ID and password and
will prompted multiple times to confirm that you are sure you want to deactivate
your product.
License Paths
The License Manager will only work for people under active maintenance and
can be downloaded from the customer portal. You can activate or deactivate your
products using the License Manager, as well as see all products you have
installed on that computer.
147
Chapter 3:
Common Tasks with SolarWinds
SAM
The features and flexibility provided by Server & Application Monitor give highly
detailed insight into the performance quality of applications on your network. The
tasks presented in this chapter illustrate the value of Server & Application Monitor,
and how it can immediately offer you a significant return on your investment:
l
l
l
l
l
l
l
l
l
148
149
150
151
152
153
6.
7.
8.
9.
10.
11.
154
4. Click Next and then select Web Pages from the drop-down menu.
5. Check Web Link and select Inherit credentials from Template. Click Test
and then click Next.
155
6. On the Change Properties page, review properties you wish to change and
then click, OK, Add Node.
7. Navigate to the Node Details page to review the results. To do this, click the
Home tab then drill down to your specific node in the All Nodes resource.
156
157
To create a new Application Monitor using the browsing method to select the
Resource Pool Represents a set of physical resources which may be a
single host, a subset of a host's resources, or resources spanning multiple
hosts. You can subdivide Resource pools by creating child resource pools.
In order to run, a virtual machine must be associated as a child of a resource
pool. In a parent/child hierarchy of resource pools and virtual machines, the
root resource pool is the single resource pool that has no parent pool.
l Virtual Machine Managed object type for manipulating virtual machines,
including templates that can be repeatedly deployed as new virtual
machines. This object type provides methods for configuring and controlling
a virtual machine.
14. If you selected the A single system option in step 11, select the desired
VMware Entity to monitor.
15. Select the desired Performance Object (group) to monitor. For example, if
you want to monitor CPU counters, select CPU.
16. Select the check boxes next to the counters to monitor for the selected Performance Object.
Note: To select all the counters listed, select the check box next to
Counter.
l
The selected counters are listed in the Selected items list with a red X
next to each one. To delete an item, click the red X next to the item and it
will be removed from the list.
17. If you want to select counters from an additional Performance Object,
select the next Performance object and then add the desired counters for it.
18. When you are finished selecting counters, click Next.
19. If you selected the A single system option in step 12, select the desired
counter instances to monitor:
a. Use the Group By drop down to display the counters for a particular Performance Object, or select All Counters.
b. Click the name of the desired counter to choose its instances.
c. Select the check box(es) next to the desired instance(s) to monitor.
Note: To select all the instances listed, select the check box next to
Instance Name.
The selected instances are then displayed in the Selected items list
with a red X next to each one. To delete an item, click the red X next to
the item and it will be removed from the list.
d. When you are finished selecting counter instances, click Next.
20. The Edit Properties page is displayed with the component monitors that
have been created for each of your selected counters or counters/instances.
Here you can modify settings such as the Monitor Name, which defaults to
158
159
10.
11.
12.
13.
14.
15.
16.
17.
To create an alert that restarts any stopped Windows services and sends an
email:
1. Click Start > All Programs > SolarWinds Orion > Alerting, Reporting,
and Mapping > Advanced Alert Manager.
2. Click Configure Alerts.
3. Scroll to the bottom of the list in the Manage Alerts dialog, and check the
box for Restart a service.
4. If you would also like to send an e-mail notification for the service
restart:
a. Highlight Restart a service and click Edit.
b. Select the Trigger Actions tab and then click Add New Action.
c. Select Send an E-Mail / Page and click OK.
160
161
162
163
Chapter 4:
Managing the Web Console
The SAM Web Console is an integral part of the SolarWinds family of products
that can be configured for viewing from virtually any computer connected to the
Internet. You can also customize the web console for multiple users and store
individually customized views as user profiles. Administrator functions are
accessed by clicking Settings in the top right of all SolarWinds Web Console
views.
The SolarWinds Web Console administrator manages the SolarWinds Website
using the commands listed in the various categories on the Settings page.
You can manage SolarWinds SAM nodes, groups, accounts, alerts, views, and
settings. You can also manage the navigation and look of SolarWinds SAM and
view information about available product updates. This guide is designed to
mirror the SAM interface, as shown below.
Note: If links appear not to work or misdirect you, clear your web cache which can
be done by clicking the Clear Web Cache button at the top right of the Settings
page, or by going through your browser's Options menu.
164
165
Refer to the sections that follow for details about the administrative commands
Refer to the sections that follow for details about the administrative commands available in each category:
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
166
l
l
Agents
Agent Settings
Discovery Central
Click Discovery Central on the Settings page to view a centralized overview of
the types and number of network objects you are monitoring with your currently
installed SolarWinds products.
Refer to Discovering and Adding Nodes on a Network.
Network Sonar Discovery
Click Network Sonar Discovery on the Settings page to discover a range of
nodes in your SolarWinds SAM.
For more information, refer to Network Sonar Discovery.
Add a Node
Click Add a Node on the Settings page to add a single device to your
SolarWinds SAM.
For more information, see "Adding Nodes for Monitoring".
Click Manage Nodes on the Settings page to add, view, and manage all nodes
and resources managed or monitored by your SolarWinds SAM installation.
167
Virtualization Settings
Virtualization Settings
Click Virtualization Settings on the Settings page to open the Virtualization
Settings view. Here you can view a list of currently monitored VMware ESX
Servers, VMware credentials, as well as Hyper-V information.
For more information, refer to Virtualization.
Manage Dependencies
Click Manage Dependencies on the Settings page to manage dependencies for
your SolarWinds SAM.
For more information, see "Managing Groups and Dependencies".
Manage Groups
Click Manage Groups on the Settings page to manage groups for your
SolarWinds SAM.
For more information, see "Managing Groups and Dependencies".
Accounts
The Accounts category gives you access to the commands for managing
accounts, permissions, and views.
Refer to the following sections for more information:
l
l
Manage Accounts
Account List
Manage Accounts
Click Manage Accounts on the Settings page to manage user accounts,
permissions, and views.
For more information, see "Managing Accounts".
Account List
Click Account List on the Settings page to open the SolarWinds Website
Accounts view, providing an immediate overview of web console user account
settings.
You may use this view to make changes to multiple accounts simultaneously and
immediately by clicking to check or clear options. Clicking an Account user
name opens the Account Manager for the selected account.
For more information, see "Managing Accounts".
168
Customize
The Customize category provides commands to customize the navigation and
appearance of your SolarWinds Web Console.
Refer to the following sections for more information:
l
l
l
l
Color Scheme
Click Color Scheme on the Settings page to select a default color scheme for
resource title bars.
For more information, see "Changing the Web Console Color Scheme".
External Websites
Click External Websites on the Settings page to designate any external website
as a SolarWinds Web Console view, appearing in the Views toolbar.
For more information, see "Creating and Editing External Website Views".
169
Manage Alerts
Manage Alerts
The Manage Alerts category gives you access to the commands that allow you to
edit, disable, enable, or delete currently configured advanced alerts.
Refer to the following section for more information:
l
Views
The Views category gives you access to the commands that allow you to manage
individual web console views as well as views for device and application types.
Refer to the following section for more information:
l
l
l
l
l
Manage Views
Add New View
Views by Device Type
Views by Application Type
Customizing Views
170
Manage Views
Click Manage Views on the Settings page to add, edit, copy, or remove individual
web console views.
For more information see Customizing Views".
Settings
The Settings category gives you access to the commands that allow you to
manage configuration settings for the Web Console, polling, SAM, and
thresholds.
Refer to the following sections for more information:
l
l
l
l
171
Polling Settings
Polling Settings
Click Polling Settings on the Settings page to define the configuration of polling
intervals, timeouts, statistics calculations, and database retention settings for your
SolarWinds SAM polling engine.
For more information, see "SolarWinds Polling Settings".
SAM Settings
Click SAM Settings on the Settings page to configure SolarWinds SAM and its
templates and component monitors.
For more information refer to SolarWinds SAM Settings.
SolarWinds Thresholds
Click SolarWinds Thresholds on the Settings page to configure SolarWinds
SAM threshold settings.
For more information, see "SolarWinds General Thresholds".
Virtualization Thresholds
Click Virtualization Thresholds on the Settings page to configure SolarWinds
SAM virtual threshold settings for VMware and Hyper-V objects.
For more information, see "SolarWinds General Thresholds".
Details
The Details category gives you access to the commands that allow you to view
configuration details for the database, polling engines, licenses, and modules.
Refer to the following sections for more information:
l
l
l
l
Database Details
Polling Engines
Orion Core Details
License Details
Database Details
Click Database Details on the Settings page to display details about the SQL
Server database currently used. For more information, see "Data and Database
Settings".
172
Polling Engines
Click Polling Engines on the Settings page to show the status and selected
configuration information for each currently operational polling engine. For more
information, see "Managing SolarWinds SAM Polling Engines".
License Details
Click License Details on the Settings page to display details about both your
SolarWinds SAM license and your monitored network.
This page also shows the version of the applications that you are running and the
versions of associated DLLs.
173
174
5. Save web.config.
Note: If you run the Configuration Wizard after editing this setting, your
changes may be overwritten.
Unmanaging Nodes
Adding Nodes for Monitoring
175
Unmanaging Nodes
l
l
l
l
l
l
l
l
l
l
Unmanaging Nodes
If you need to deactivate nodes for a period of time, you can do so by unmanaging
them. Changes you make to the managed or unmanaged status of a node takes
affect after the next polling cycle.
To unmanage a node:
1.
2.
3.
4.
5.
6.
176
177
12.
13.
14.
15.
16.
17.
18.
178
19.
20.
21.
22.
23.
24.
179
IP Address
Machine Type
Average
Response Time
Packet Loss
CPU Load
180
Memory Used
181
182
183
184
185
186
Select either New Task or open an existing task by clicking Edit Task.
Click Add Items.
Click on the Web tab.
Select the items you want to schedule to be stopped by checking the check
box next to the item name.
Click Add.
Select the length of time you would like the selected item to be stopped.
Click OK.
Optionally, you can click Save Task to save your selections for future use.
To view the details of a selected item's schedule, simply check its box and its
details will appear in the Task Item Properties pane on the right.
187
188
189
190
191
Customizing Views
SolarWinds Web Console views are configurable presentations of network
information that can include maps, charts, summary lists, reports, events, and
links to other resources. Customized views can then be assigned to menu bars.
Note: In environments where security is a priority, SolarWinds recommends
against providing a view where users may change their own web console
account passwords.
192
193
Editing Views
After you have created a new view, the Customize Your View page opens. For
more information, see Editing Views.
Editing Views
The SolarWinds Web Console allows administrators to configure views for
individual users. The following steps are required to configure an existing view.
To edit an existing view:
1. Click Settings in the top right of the web console.
2. Click Manage Views in the Views group of the SolarWinds Website Administration page.
3. Select the view you want to customize from the list, and then click Edit.
4. If you want to change the column layout of your view, complete the following steps.
a. Click Edit to the right of the column widths.
b. Select the number of columns under Layout.
e. Provide the width, in pixels, of each column in the appropriate fields,
and then click Submit.
5. If you want to add a resource, repeat the following steps for
each resource:
a. Click [+] next to the column in which you want to add a resource.
b. Click [+] next to a resource group on the Add Resources page to
expand the resource group, displaying available resources.
c. Check all resources you want to add.
d. If you have completed the addition of resources to the selected
view, click Submit.
Notes:
l Resources already in your view will not be checked on this page
listing all web console resources. It is, therefore, possible to pick
duplicates of resources you are already viewing.
l Some resources may require additional configuration. For more
information, see Resource Configuration Examples on
page197.
l Several options on the Add Resources page are added to the list
of resources for a page, but the actual configuration of a given
map, link, or code is not added until the page is previewed.
6. If you want to delete a resource from a column, select the resource, and
then click X next to the resource column to delete the selected resource.
7. If you want to copy a resource in a column, select the resource, and
then click next to the resource column to delete the selected resource.
194
Available Limitations
Group of Nodes
SAM Summary
Single Hardware
Manufacturer
Cluster Details
Group of Machine
Types
Group of Volumes
Custom Summary
Machine Type
Pattern
Single Group
Datacenter Details
Hardware
Manufacturer
Group of Groups
195
Device Status
Group Details
System Location
Group Summary
System Location
Pattern
Group of Application
Names
Node Details
System Contact
Specific Applications
SolarWinds Summary
Home
Customize Problem
Areas
Virtual Center Details
Virtualization summary
Volume Details
Copying Views
When you want to create multiple views based on the same device type, copying
views allows you to create one view, and then use that view as a template to
create other new views. The following steps copy an existing view.
196
Deleting Views
The following steps delete an existing view.
To delete an existing view:
1. Click Settings in the top right of the web console.
2. Click Manage Views in the Views grouping of the SolarWinds Website
Administration page.
3. Select the view you want to delete, and then click Delete.
197
198
199
200
201
202
203
Grouping Nodes
12. provide the text or IP address range by which you want to filter your node list
in the Filter Text field, as shown in the following examples:
l Type Home in the Filter Text field to list all nodes with Home in the
node name or as a location.
l Type 192.168.1.* in the Filter Text field to list all nodes in the
192.168.1.0-255 IP address range.
13. Select the property that is appropriate to the filter text provided above, as
shown in the following examples:
l If you typed Home in the Filter Text area, select Node Name or
Location to list nodes with Home in the node name or as a location.
l If you typed 192.168.1.*in the Filter Text area, select IP Address to
list only nodes in the 192.168.1.0-255 IP address range.
l If you want to apply a SQL filter to the node list, enter an appropriate query in the Filter Nodes (SQL) field.
Notes:
l Filter Nodes (SQL) is an optional, advanced, web console feature that requires some knowledge of SQL queries. Click [+] next
to Show Filter Examples to view a few example filters.
l By default, node list resources are designed to sort nodes alphabetically by node caption. This configuration cannot be overwritten using a SQL filter, so order by clauses included in SQL
filters are redundant and will result in Custom SQL filter formatting errors.
14. Click Submit.
Grouping Nodes
Your SolarWinds Web Console can maintain a customizable node list for your
network. Node lists may be configured for specific views with node grouping. The
following steps set up node grouping for node lists included in web console
views.
Note: Clicking the resource title in the title bar menu displays the resource by
itself in a browser window.
To enable grouping on a node list:
1. Create a new view or edit an existing view.
Note: For more information, see Customizing Views.
2. Select the view to which you want to add the node list, and then click Edit.
3. Click [+] next to the view column in which you want to display the node list.
4. Click [+] next to Node Lists.
204
12.
205
4.
5.
6.
7.
8.
9.
play from left to right in the edited menu bar as they are listed from top to
bottom.
If you want to create a new menu bar, complete the following steps:
a. Click New Menu Bar, and then provide a Name for the New Menu
Bar.
b. Click and drag the buttons you want to include in your new menu bar
from the Available items list on the left to their correct relative locations
in the Selected items list on the right.
Note: Hover over any view title to read a view description. Selected
items display from left to right in the new menu bar as they are listed
from top to bottom.
If you want to add menu items, complete the following steps:
a. Click Edit under the menu bar to which you are adding the new item.
b. Click and drag the items you want to include in your new menu from the
Available items list on the left to their correct relative locations in the
Selected items list on the right.
Notes:
l Hover over any view title to read a view description. Selected
items display from left to right in the new menu bar as they are listed from top to bottom.
l If you check Reports from the Select Menu Items page, you must
also enable reports for the accounts that use the menu bar. For
more information, see Configuring an Account Report Folder on
page306.
If you want to add a custom menu item, complete the following steps:
a. Click Edit under the menu bar to which you are adding the custom item.
b. Click Add.
c. Provide the Name, URL, and Description of your custom menu
item.
d. If you want the menu option to open in a new window, check
Open in a New Window.
e. Click OK.
If you want to delete a menu item, click and drag the item to delete from
the Selected items list on the right to the Available items list on the left.
Warning: Do not delete the Admin option from the Admin menu bar.
If you want to change the location of an item in your menu, click and
drag items to move them up and down in the Selected items list.
If you have finished editing your menu bar, click Submit.
206
207
NOCView
SAMoffers a Network Operations Center (NOC) view that hides console tools
while automatically rotating through custom views. NOC view mode enables you
to customize views for optimal display on large network operations center
screens. Once you click on an object in NOC view mode, you will be taken out of
NOCview mode and then taken to that object's details page.
208
While in the NOCview you can easily exit and edit the NOC view from the web
console by the menu provided in the upper right-hand corner of the web console,
as shown:
Enabling NOC
Adding NOCviews
Editing NOCviews
Disabling NOCviews
Adding AppStack to a NOC View
Enabling NOC
NOC view mode enables you to customize web console views for optimal display
on large network operations center screens.
To enable NOC view mode for an existing view:
1. Click Customize Page in the top right of the view for which you want to
enable NOC view mode.
2. Check Enable NOC view mode.
3. Click Done.
Adding NOCviews
Adding a NOCview:
209
Adding NOCviews
1. From the web console, click Customize Page in the upper right-hand
corner.
2. If not already done so, check Enable Left Navigation.
6. Add the resources you want to each column by clicking the green [+], then
selecting resources from the pop-up dialog, as shown:
210
211
212
213
Disabling NOCviews
2. Check the view you want to edit, and then click Edit.
2. Check the view you want to edit, and then click Disable NOC.
214
3. Confirm the dialog to have your view removed from the list.
l
l
View chart data over the Last 7 Days or over the Last 30 Days
Select Edit Chart to view and modify chart settings.
Note: This is the same as clicking Edit in the title bar.
View Chart Data as an HTML format document
View Chart Data in Excel to see chart data in an Excel-compatible format
215
Last 2 Hours
Yesterday
Last 7 Days
This Month
Last Month
Last 12 Months
The Sample Interval for the selected chart may be any of the following:
Every Minute
Every 2 Hours
Every 12 Hours
Every 7 Days
One a Day
Every 6 Hours
Notes:
l Each sample interval is represented on a chart by a single point or bar. Data
within a selected sample interval is summarized automatically.
l Due to limits of memory allocation, some combinations of time periods and
sample intervals require too many system resources to display, due to the
large number of polled data points. As a result, charts may not display if the
time period is too long or if the sample interval is too small.
The Trend Line option allows you to enable the trend line feature of SolarWinds
SAM charts. By enabling trend lines on SolarWinds SAM charts, you can see
potential future results as they are extrapolated from collected historical data.
Note: Due to the broad array of factors that can affect the performance of devices
on your network, trend lines provided on SolarWinds SAM charts are intended as
approximate predictions of future data only. For more information, see "95th
Percentile Calculations" on page 1221.
216
217
218
219
220
221
Note: The string supplied for Title is the name for the added script or
application that will display in the menu. The string supplied for the
ExecString is the path to the script or application executable file.
6. Save the new SWToolset.MenuOptions to automatically update the Toolset Integration menu.
222
223
224
If you have configured the SolarWinds Web Console to check for product
updates, an announcement displays in the notification bar when an update,
including any upgrade, service pack, or hotfix, to SolarWinds SAM or any
other SolarWinds modules you currently have installed becomes available.
For more information about SolarWinds Product Updates, see Product
Updates.
If you have configured the SolarWinds Web Console to store blog posts,
new and unread posts to the SolarWinds Product Team Blog are
announced in the notification bar. For more information about SolarWinds
Product Updates, see Product Updates.
If you have currently configured a scheduled discovery, results display in
the notification bar when the discovery completes. For more information
about Scheduled Discovery, see Discovery Central."
If you are currently using SolarWinds SAM to monitor any VMware ESX or
ESXi Servers, the notification bar can display messages communicating the
number of ESX nodes found during any discovery, and, if any discovered
ESX nodes require credentials, the notification bar tells you. For more
information about managing ESX Servers, see Virtualization.
For more information about any displayed notification bar message, click
More Details and a web console view relevant to the displayed message
opens.
To delete a posted message, either click Dismiss Message next to the displayed message, or properly address the situation mentioned in the posted
notification.
To remove the notification bar from your web console, click Close (X) at the
right end of the notification bar.
225
Suppressing Events
There is no option within SAM to suppress event types from the web console;
however, suppression can be accomplished by modifying the database directly.
You can suppress specific events based on the event type. In order to do this,
refer to the following screenshot and steps:
226
227
228
229
Click Customize Page in the top right corner of the web console.
Click the [+] in either column.
Search for "Audit."
Select the resource you want, and then click Add Selected Resources.
Click Done.
230
231
232
233
Chapter 5:
SolarWinds SAMCharts and
Resources
Following is a list of the available charts within SAM:
l
l
l
l
l
l
l
l
l
l
l
l
l
l
The tooltip indicates the number of times the application was in a certain state.
For example, in the previous illustration, an application was polled 12 times in
one hour (every five minutes) and was deemed available (up) 10 times, in a
Critical state once, and in a Warning state once.
234
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders in the smaller chart below the
main chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.
Note: The Export button will open the Custom Chart allowing you to export this
data to both MS Excel and HTML.
Custom Chart
The Custom Chart resource allows you to easily view data based on your needs.
To customize it, simply click Edit in the upper right-hand corner of the resource.
235
Custom Chart
From the Edit page, you can define the titles, datasource, time period, labels,
units displayed, the type of chart to be used, and an optional sum of the data.
To customize your chart:
1.
2.
3.
4.
5.
6.
7.
236
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
237
Use the check box in the legend as a toggle to show/hide data on the chart.
Clicking Export will allow you to export the data to either an HTML or Excel file.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
238
Use the check box in the legend as a toggle to show/hide data on the chart.
Clicking Export will allow you to export the data to either an HTML or Excel file.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
239
Clicking the Edit button will provide a menu of components to choose from to
have represented on the chart, as the following illustration depicts:
Note: This option is only available on the Application Details page and not the
Component Details page. Clicking the chart itself, as opposed to the Edit button,
will bring up additional, self-explanatory options.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
240
241
Sample Interval
l
Sample Interval
The sample interval dictates the precision of a given chart. A single
point or bar is plotted for each sample interval. If a sample interval
spans multiple polls, data is automatically summarized and plotted as
a single point or bar on the chart.
Note: Due to limits of memory allocation and the large number of
polled data points, some combinations of time periods and sample
intervals may require too many system resources to display. As a
result, charts may not display if the time period is too long or if the
sample interval is too small.
Chart Size
Chart Size options configure the width and height, in pixels, of the
chart. You can maintain the same width/height aspect ratio, or scale
the chart in size, by entering a width in the Width field and then
entering 0 for the Height.
Font Size
Font sizes for generated charts are variable. The Font Size option
allows you to select a Small, Medium, or Large size font for your chart
labels and text.
Note: Font Size selections are maintained in the printable version of
your chart.
Data Export Options
The Display Data from Chart area provides the following options to
export chart data as either Excel-compatible Raw Data or as
HTML-formatted Chart Data:
l
242
Use the check box in the legend as a toggle to show/hide data on the chart.
Clicking Export will allow you to export the data to either an HTML or Excel file.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
243
Custom Table
is run against your SolarWinds database, and the results are displayed in an
appropriate grid.
Clicking Edit allows you to configure your Custom Query resource, as indicated
in the following procedure.
To configure a Custom Query resource:
1.
2.
3.
4.
Custom Table
The Custom Table resource allows you to easily view data that can be
customized to suit your needs. To customize it, simply click Edit in the upper
right-hand corner of the resource.
244
l
l
l
l
Title and subtitle: Used to change the labels of the Title and Subtitle.
Datasource: This will allow you to create queries and add conditions.
When you add a condition, you will be given the option to add a field or use
pre-existing fields. Your choices will be reflected in the Custom Table
resource once it has been updated.
Time Period: Select the time period for data to be displayed in the resource.
Table Layout: Once a Datasource is selected, you can add columns and
then arrange them by dragging them into position. Clicking [X] will delete
the column from view.
Sort Results: Allows you to choose how the data will be sorted and displayed.
Group Results: Allows you to choose how the data will be grouped.
Filter Results: Allows you to choose how many records will be displayed
based on either a set number or a percentage.
245
Availability
AvailabilityAutoscale
Availability and Response Time
246
Memory Usage
The following charts present memory usage information over custom time periods
for nodes monitored by SolarWinds.
l
l
l
l
247
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, and Last Page.
248
Alerts with this resource can be used with the complete message text of events.
For more information see, "Other Syslog Variables" on page 1171.
This collection of detailed data is enabled by default. To disable this, navigate to
the event log monitor component, as shown below:
249
CPU Load
Physical Memory
Virtual Memory
Response Time
Statistic Data
Clicking Edit also reveals several self-explanatory options. Clicking Export will
allow you to export the data to both Excel and HTML formats.
This resource is made up of three sections: the toolbar, the main chart, and the
lower chart. This allows you to visualize the selected data by viewing the
minimums, maximums, and averages of the data for a selected time period.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 Day, 1 Week, or 1 Month, as highlighted in
the above illustration. Alternatively, you can have the chart show a specific date
250
251
252
253
Zooming
The Multiple Statistic Chart can be added to either the Application Details
page or the SAM Component Details page.
To add the Multiple Statistic Chart to either page, take the following steps:
1. Drill down to either the Application Details page or the SAM Component
Details page.
2. Click Customize Page on the far top right of the page.
3. Click the green [+] to the right of the column in which you want to add this
chart.
4. Select and expand SAM Charts - Historical charts for SAM.
5. Check Multiple Statistic Chart, and then click Submit, then click Done.
To configure the Multiple Statistic Chart, take the following steps:
1. Once the chart is on your Details page, click Edit at the top right of the
chart.
2. From this page, you can have several options to choose from, including:
i. Title: This allows you to change the title of your chart.
ii. Select a Time Period: This allows you provide a range for your chart.
iii. Select a Sample Interval: This allows you to select how often the chart
is updated.
254
Multi Chart
This chart provides the ability to graphically visualize multiple statistics
simultaneously at the application level without the need to drill down into each
component monitor.
The advantage of this view is that you can easily determine how certain
processes are performing in relation to others. For example, you may notice that a
spike in RAM usage results in higher CPU usage. This charted information allows
you to get a quick overview of what is being monitored and may answer why
certain unexpected events are occurring.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons at the top of the chart. Alternatively, you can
have the chart show a specific time range by dragging the mouse over a small
area of the chart, or by adjusting the sliders in the smaller chart below the main
chart.
The Multi Chart can be added from the Application Details page.
255
Multi Chart
To add the Multi Chart to the Application Details page, take the following
steps:
1. Drill down to the Application Details page.
2. Click Customize Page on the far top right of the page.
3. Click the green [+] to the right of the column in which you want to add this
chart.
4. Search for "Multi Chart."
5. Check Multi Chart, and then click Add Selected Resources, then click
Done.
To configure the Multi Chart, take the following steps:
1. Once the chart is on your Application Details page, click either Edit, Select a
chart, or Configure this resource.
2. From this page, you have several options to choose from, including:
i) Title: This allows you to change the title of your chart.
ii) Subtitle: This allows you to change the subtitle of your chart.
256
257
Chapter 6:
SolarWinds SAM Settings
You can configure Applications, Templates, and Component Monitors through the
SolarWinds Web Console by using the SAM Settings page.
258
l
l
l
l
l
l
l
l
l
l
l
l
259
Application Monitors
Application Monitors
The Application Monitors category gives you access to the commands that allow
you to actively monitor nodes using a collection of component monitors to
determine the overall health of applications.
For more information, see Managing Assigned Application Monitors on
page344.
Manage Templates
Click Manage Templates on the SAM Settings page to edit, copy, export, import,
and delete templates.
For more information, see Managing Templates on page397.
Component Monitors
Component monitors are the building blocks of SolarWinds SAM. This category
gives you access to the commands that allow you to monitor the status and
performance of different aspects of an application.
Refer to the following sections for more information:
260
l
l
l
SAM Settings
The SAM Settings category gives you access to the commands that allow you to
view and manage the SAM Settings for credentials and data access.
l
l
261
Credentials Library
For more information, see "Data and Database Settings"
Credentials Library
Click Credentials Library on the SAM Settings page to create, edit, and delete
the credential sets component monitors use to access protected system
resources.
For more information, see Understanding the Credentials Library on page340.
Database Maintenance
The amount of data collected in the database is dependent upon the size of the
data collected as well as the number of applications and component monitors you
define.
Due to the volume of data collected, detailed statistics are stored in hourly
averages after a specified time period (7 days, by default). Hourly statistics are
compressed into daily statistics after a number of days (30 days, by default).
Detailed statistics retention is based on the individual polling intervals for each
component monitor. These settings allow you to set a length of time after which
SolarWinds SAM purges data from the database.
Note: Before modifying your database settings, consider noting your database
size and amount of data collection for a week. When the week is complete,
recheck your database size. This should help you forecast and plan for an
appropriate data compression and retention period.
To set the three Statistic Retention Intervals:
1. Log on to your SolarWinds Web Console with an Administrator account.
Note: Initially, Admin is the default administrator user ID with a blank password.
262
License Summary
The License Summary category gives you access to the command that allows
you to view the license information summary.
For more information, see "SAM License Summary" on page 263.
thwack Community
The thwack Community category gives you access to the commands that allow
you to view and download useful information from the thwack community for
263
264
Chapter 7:
Discovering and Adding Nodes on a
Network
There are two methods to add nodes in SolarWinds SAM:
l
This chapter describes the process of discovering network devices and then
adding them to the Orion database via Network Sonar Discovery.
The method recommended largely depends on the number of nodes to be added.
To discover and add a larger number of nodes across your enterprise, the
Network Sonar Discovery and Network Sonar Results wizards are available,
respectively. This chapter provides instructions for quickly populating your
SolarWinds SAM database with the nodes you want to monitor and manage with
SAM. The Web Console also provides an easy to use Web Node Management
wizard suited to discovering and adding individual nodes.
Refer to the following sections for more information:
l
l
l
l
l
Discovery Central
Network Sonar Discovery
Using the Network Sonar Results Wizard
Managing Scheduled Discovery Results
Using the Discovery Ignore List
Discovery Central
Discovery Central provides a centralized overview of the types and number of
nodes you are monitoring. You can also access Network Discovery and
Virtualization Discovery from within Discovery Central.
265
Virtualization Discovery
Application Discovery
Virtualization Discovery
The Virtualization Discovery category displays information for both VMware and
Hyper-V infrastructures on your network. To use virtualization discovery, click
Network Sonar Discovery to discover multiple nodes or click Add A Single
Device to add a single node. For more information, see Polling for VMware
nodes Using the Network Sonar Wizard on page 327.
Application Discovery
SolarWinds SAM can scan nodes and automatically assign the Application
Monitors it deems suitable for each scanned node. You control the nodes to be
scanned, the application templates used in the scan, and the scanning
parameters that determine a match. For more information, see "Application
Discovery" on page 277.
The Network Sonar Wizard recognizes network devices that are already in
your Orion database and prevents you from importing duplicate devices.
CPU and Memory Utilization charts are automatically enabled for your Windows, Cisco Systems, VMware, and Foundry Networks devices.
The community strings you provide in the Network Sonar Wizard are only
used for SNMP GET requests, so read-only strings are sufficient.
The following procedure steps you through the discovery of devices on your
network using the Network Sonar Wizard, automatically followed by the Network
Sonar Results Wizard:
266
267
8. Tc Check all existing nodes polling with agents for node changes and
updates, check the box provided. when done, click Next.
268
10. If you want to discover devices located on your network within a specific range of IP addresses, complete the following procedure.
Note: Only one selection method may be used per defined discovery.
a. Click IP Ranges in the Selection Method menu, and then, for each IP
range, provide both a Start address and an End address.
Note: Scheduled discovery profiles should not use IP address ranges
that include nodes with dynamically assigned IP addresses (DHCP).
b. If you want to add another range, click Add More, and then repeat
the previous step.
Note: If you have multiple ranges, click X to delete an incorrect range.
c. If you have added all the IP ranges you want to poll, click Next.
269
270
271
14.
15.
16.
17.
272
273
274
275
276
Chapter 8:
Application Discovery
SolarWinds SAM can scan nodes and automatically assign the Application
Monitors it deems suitable for each scanned node. You control the nodes to be
scanned, the application templates used in the scan, and the scanning
parameters that determine a match.
To Access Application Discovery:
1. Click Settings at the top right of the SolarWinds Web Console.
2. Now click Discovery Central in the Getting Started with SolarWinds category.
3. In the Application Discovery category, click Discover Applications to
begin using the wizard-like interface.
For more information, see Add Application Monitors.
Select Nodes
1. Click [+] in the list to expand the node groups and to select the nodes you
want to scan.
2. When you are finished selecting nodes, click Next.
Select Applications
To keep the scanning time to a minimum, we recommend you initially
scan for a limited number of application templates. To see more
application templates, select a different template group from the Show
Only list.
To adjust the template assignment criteria, expand Advanced Scan
Settings and move the slider to the desired setting:
Exact Match
All the components must match to assign the template.
Strong Match
Most of the components must match to assign the template.
277
278
Add UX Monitors
Summary Page (or > SAM Application Summary) to display the
SAM summary page.
Add UX Monitors
You cannot scan for user experience (UX) monitors, but you can
assign them to nodes manually. Adding monitors from this page does
not affect your scan.
279
280
281
282
Fields:
l
Process Name: Displays the name of the listed process. Clicking a process in the list will take you to the Component Details page for that process.
Application Name: Displays the name of the listed application that contains the listed process. Clicking an application in the list will take you to
the Application Details page for that application.
283
Network Node: Displays the name of the listed node that contains the listed application and process. Clicking a node in the list will take you to the
Node Details page for that node.
IO Reads: Displays the current rate of Input/Output reads.
Note: Clicking Edit will allow you to change the Title, Sub-Title, and Maximum
Number of Monitors to Display.
Hovering the mouse over any part of this resource will reveal a tooltip with
detailed information about the item listed.
For more information, see the following:
l
l
Fields:
l
Process Name: Displays the name of the listed process. Clicking a process in the list will take you to the Component Details page for that process.
Application Name: Displays the name of the listed application that contains the listed process. Clicking an application in the list will take you to
the Application Details page for that application.
Network Node: Displays the name of the listed node that contains the listed application and process. Clicking a node in the list will take you to the
Node Details page for that node.
IO Writes: Displays the current rate of Input/Output writes.
284
Fields:
l
Process Name: Displays the name of the listed process. Clicking a process in the list will take you to the Component Details page for that process.
Application Name: Displays the name of the listed application that contains the listed process. Clicking an application in the list will take you to
the Application Details page for that application.
Network Node: Displays the name of the listed node that contains the listed application and process. Clicking a node in the list will take you to the
Node Details page for that node.
Total IOPS: Displays the current rate of Input/Output.
Note: Clicking Edit will allow you to change the Title, Sub-Title, and Maximum
Number of Monitors to Display.
Hovering the mouse over any part of this resource will reveal a tooltip with
detailed information about the item listed.
For more information, see the following:
285
l
l
286
Expired Warranties: Lists the nodes that currently have expired warranties.
Warranties Due to Expire: Lists the nodes that have warranties nearing
their expiration date.
Next 5 Warranties Set to Expire: Lists the top five warranties nearing their
expiration date.
Clicking Edit will allow you to fine tune the information displayed in this resource,
as shown below:
287
Chapter 9:
Managing Groups and Dependencies
Groups and dependencies enable you to more effectively manage your network.
Groups give you the ability to logically organize monitored objects, regardless of
device type or location, and dependencies allow you to more faithfully represent
what can actually be known about the nodes of your network, eliminating false
positive alert triggers and providing more accurate insight into the state of your
nodes.
Groups contain SolarWinds objects that report a status such as nodes, volumes,
applications, and even other groups. You create, delete, and modify groups from
the Manage Groups page.
Note: Nesting a group within another does not create a strict parent/child
relationship. You can include any group as a member in any number of other
groups.
To access the Manage Groups page:
1. Log on to the SolarWinds Web Console.
2. Click Settings in the top right of the web console.
3. Click Manage Groups in the Node & Group Management grouping of the
SolarWinds Website Administration page.
The following sections provide more information about creating and managing
groups in SAM:
l
l
Creating Groups
Managing the Display of Group Status
Creating Groups
Creating a group is a straightforward process of selecting the SolarWinds objects
you want the group to contain. At creation time, you can also decide how you
want SolarWinds to roll up the status of the group members.
288
Editing Groups
Managing Group Members
Deleting Groups
Managing the Display of Group Status
289
Editing Groups
character wildcard. Use the underscore (_) character as a
single character wildcard.
e. Click Preview to verify that the dynamic query is selecting your
intended objects.
f. Click Save.
12. Continue adding individual SolarWinds objects or dynamic queries until
you have finished building your group.
13. Click Create Group.
Editing Groups
You can edit the properties of an existing group or add and remove objects.
These are separate editing tasks.
To edit properties of an existing group:
1. Click Start> All Programs> SolarWinds > Orion Web Console.
2. Click Settings in the top right of the web console.
3. Click Manage Groups in the Node & Group Management grouping of the
SolarWinds Website Administration page.
4. Check the group you want to edit, and then click Edit Properties.
5. Edit the Name and Description of the selected group, as appropriate.
6. If you want to manage the members of the selected group, click Add &
Remove Objects. For more information about managing group members,
see Managing Group Members.
Note: Expand the Contains summary for the selected group to see all member objects in the group.
7. If you want to configure the calculation of displayed group status or
the frequency with which group status is refreshed, expand Advanced,
select a Status rollup mode, and then provide a Refresh frequency.
Note: For more information about status rollup for groups, see Managing the
Display of Group Status.
8. Click Submit.
290
Deleting Groups
Deleting an existing dependency is a straightforward process, as shown in the
following procedure.
To delete a group:
1. Click Start> All Programs> SolarWinds > Orion Web Console.
2. Click Settings in the top right of the web console, and then click Manage
Groups in the Node & Group Management grouping of the SolarWinds
Website Administration page.
3. Check the group you want to delete, and then click Delete.
Group Status
(Up)
(Up)
(Warning)
291
Group Status
(Down)
(Warning, Down)
(Warning)
(Down)
Mixed Status shows Warning ensures that the status of a group displays the
worst warning-type state in the group. If there are no warning-type states, but the
group contains a mix of up and down states, then a Mixed Availability ( ) warning
status is displayed for the whole group. The following table indicates how the
Mixed Status shows Warning option operates:
Object States Group Status
(Critical)
(Critical)
(Mixed Availability)
The following procedure configures the method used to determine group status.
To configure the method used to determine the status of a selected group:
1. Click Start> All Programs> SolarWinds > SolarWinds Web Console.
2. Settings in the top right of the web console, and then click Manage
Groups in the Node & Group Management grouping of the SolarWinds
Website Administration page.
3. Check the group you want to edit, and then click Edit Properties.
4. Expand Advanced, and then select a Status rollup mode, as follows:
a. If you want the group to roll up the worst status of the group members, select Show Worst Status.
b. If you want the group to roll up the best status of the group members, select Show Best Status.
c. If you want the group to display a warning status if the group members have a mixture of different statuses, select Mixed Status
shows warning.
292
Managing Dependencies
Dependencies in SolarWinds allow you to account for topological constraints on
your network. These constraints may be either the result of the design of a
specific device, or the result of the physical architecture of your network itself.
SolarWinds offers an Unreachable status to account for the case when a device
may appear to be down when its status is actually indeterminate, due to another
device being down or unresponsive.
Likewise, SolarWinds also makes it possible to define dependencies among
distinct devices, as in the case of a subnet of devices on your network that
depends on a single WAN link to connect with the rest of your network. In this
case, if you have defined a group consisting of the devices in this dependent
subnet, you can then define a dependency where the dependent subnet is a child
group to the parent router that is serving as the WAN link to the rest of your
network. For more information about groups, see Managing Groups and
Dependencies.
The power of dependencies becomes evident when considering alerts. If you
have an alert configured to trigger when a monitored object is down, you only
want that alert to trigger if a monitored objects is positively down. In other words,
you do not want an down object alert to trigger for an object that is not actually
down. Without dependencies, all monitored objects on a monitored node that is
unresponsive to ICMP queries will also report as down. With dependencies in
use, these child objects will instead display as Unreachable, saving you the
hassle of sorting through numerous false alerts resulting from the failure of a
single node to respond promptly to a status query.
Refer to the following sections for more information:
l
l
l
l
Creating a Dependency
Editing a Dependency
Deleting a Dependency
Viewing Alerts on Child Objects
Creating a Dependency
Creating a new dependency is a straightforward process of selecting the parent
and children objects, as shown in the following procedure.
293
To create a dependency:
To create a dependency:
1. Click Start> All Programs> SolarWinds > SolarWinds Web Console.
2. Click Settings in the top right of the web console, and then click Manage
Dependencies in the Node & Group Management grouping of the
SolarWinds Website Administration page.
3. Click Add new dependency.
4. On the Select Parent page, complete the following steps:
a. Use the Show only: and Group by: selection fields to customize the
list of displayed objects and groups.
Note: The properties listed in the Group by selection field are
dynamic.
b. Select the parent object or group in the main pane, and then click Next.
Note: If you want to define a dependency so that the reported states of
child objects are dependent on the status of multiple parent objects, create a group including all parent objects, and then select it on this view.
For more information, see Creating Groups on page288.
5. On the Choose Child page, complete the following steps:
a. Edit the Dependency name, as appropriate.
b. Use the Show only: and Group by: selection fields to customize the
list of displayed objects and groups.
Note: Properties listed in the Group by: selection field are dynamically
dependent on the selection in the Show only: field.
c. Select the child object or group in the main pane, and then click Next.
Note: If you want to define a dependency so that the reported states of
multiple child objects are dependent on the status one or more parent
objects, create a group including all child objects, and then select it on
this view. For more information, see Creating Groups on page288.
6. On the Review Dependency view, review the current settings for the configured dependency.
Notes:
l If any advanced alerts are configured on parent or child objects,
they will be listed on this view. Click [+] to expand alert details.
l In the event that a parent object is down, all alerts configured on any
child objects in a dependency on the down parent object are automatically suppressed.
7. Click Submit to accept the dependency definition.
294
Editing a Dependency
Editing an existing dependency is a straightforward process, as shown in the
following procedure.
To edit an existing dependency:
1. Click Start> All Programs> SolarWinds> SolarWinds Web Console.
2. Click Settings in the top right of the web console, and then click Manage
Dependencies in the Node & Group Management grouping of the
SolarWinds Website Administration page.
3. Check the dependency you want to edit, and then click Edit.
4. On the Select Parent page, complete the following steps:
a. Use the Show only: and Group by: selection fields to customize the
list of displayed objects and groups.
Note: Properties listed in the Group by: selection field are dynamically
dependent on the selection in the Show only: field.
b. Select the parent object or group in the main pane, and then click Next.
Note: If you want to define a dependency so that the reported states of
child objects are dependent on the status of multiple parent objects, create a group including all parent objects, and then select it on this view.
For more information, see Creating Groups on page288.
5. On the Choose Child page, complete the following steps:
a. Edit the Dependency name, as appropriate.
b. Use the Show only: and Group by: selection fields to customize the
list of displayed objects and groups.
Note: Properties listed in the Group by: selection field are dynamically
dependent on the selection in the Show only: field.
c. Select the child object or group in the main pane, and then click Next.
Note: If you want to define a dependency so that the reported states of
multiple child objects are dependent on the status one or more parent
objects, create a group including all child objects, and then select it on
this view. For more information, see Creating Groups on page288.
6. On the Review Dependency view, review the current settings for the configured dependency.
Notes:
l If any advanced alerts are configured on parent or child objects, they
will be listed on this view. Click [+] to expand alert details.
l If a parent object is down, all alerts configured on any child objects in
a dependency on the down parent object are automatically suppressed.
295
Deleting a Dependency
7. Click Submit to accept the dependency definition.
Deleting a Dependency
Deleting an existing dependency is a straightforward process, as shown in the
following procedure.
To delete an existing dependency:
1. Click Start> All Programs> SolarWinds> SolarWinds Web Console.
2. Click Settings in the top right of the web console, and then click Manage
Dependencies in the Node & Group Management grouping of the
SolarWinds Website Administration page.
3. Check the dependency you want to delete, and then click Delete.
4. Click Yes to confirm deletion of the selected dependency.
296
Chapter 10:
Managing Accounts
SolarWinds Web Console user accounts, permissions, and views are established
and maintained with the SolarWinds Account Manager. When Advanced
Customization is enabled on the SolarWinds Website Settings page, you can use
Account Manager to customize menu bars and views for different users. For more
information, see Customizing Views.
Notes:
l This guide assumes that Advanced Customization has been enabled. If it
has not been enabled, the range of options available on the pages referenced in the following sections is much more limited. For more information, see Setting Account Limitations.
l To prevent issues with web console accounts, your SQL Server should not
be configured with the no count connection option enabled. The no count
option is set in the Default connection options area of the Server
Properties> Connections window of SQL Server Management Studio
Refer to the following sections for more information:
l
l
Creating Accounts
Editing User Accounts
Creating Accounts
New SolarWinds Web Console user accounts may be created by any web
console administrator. The following procedure creates a new web console user
account.
To create a new user account:
1. Log in to the SolarWinds Web Console as an administrator.
2. Click Settings in the top right of the web console.
3. Click Manage Account in the Accounts grouping of the SolarWinds Website Administration page.
4. Click Add New Account.
297
298
The following sections and procedures detail the configuration of user accounts.
Note: To reset a password, click Change Password at the bottom of the page.
l
l
l
l
l
l
299
300
Following the initial alert sound, you will receive an audible alert every time an
alert is encountered that was triggered later than the latest alert that has already
been viewed.
For example, a user logs in and sees a group of alerts with trigger times ranging
from 9:01AM to 9:25AM, and the user receives an audible alert. If the user
browses to a new page or allows the current page to auto-refresh, a new alert
sounds if and only if an alert triggered later than 9:25AM is then displayed.
301
302
303
304
305
9.
10.
11.
12.
13.
14.
15.
Console. If you are editing an account that must have administrator privileges, select Admin.
Select a Home Page View.
Note: If no Home Page View is specified, the default is designated to be
the same as the page that is specified in the Default Summary View field
below.
If the Home Page View you have selected refers to a specific network
device, select a Default Network Device by clicking Edit and selecting
from the list of available devices on the next page.
Note: If the Home Page View you have selected does not require a specific
network device, SolarWinds will select a device to display, automatically.
Select a Default Summary View for the account.
Note: This is typically the same as the Home Page View.
If you want all reports to be available for the account, select \Reports
from the Report folder list in the Default Menu Bars and Views area.
Note: If you are creating a new user, you must designate the Report Folder
the new account is to use to access SolarWinds reports. By default, no
report folder is configured for new users. The Reports directory is located in
the SolarWinds SAM installation directory:
C:\ProgramFiles\SolarWinds\Orion\.
If you want to designate default Node, Volume, and Group Details
Views for this account, expand SolarWinds General Settings, and then
select appropriate Node Detail, Volume Detail, and Group Detail Views.
If you want to designate default Virtualization Summary Manager,
Cluster Details, and Datacenter Details Views for this account, expand
Integrated Virtual Infrastructure Monitor Settings, and then select appropriate default views.
Click Submit.
306
307
Node Details View: This view is used when details about a single Network
Node are displayed.
Volume Details View: This view is used when details about a single physical or logical Volume are displayed.
Group Details View: This view is used when details about a single Group
are displayed.
308
309
Chapter 11:
Managing SolarWinds SAM Polling
Engines
To ensure that your polling engines are optimized to run at peak performance,
you will need to occasionally tune them. If you use more than one polling engine,
you will need to balance the load so that each engine can perform optimally.
Refer to the following sections for more information:
l
l
l
l
l
l
l
310
Polling Intervals
Polling Statistics Intervals
Network
Calculations & Thresholds
Polling Intervals
The following settings configure default polling intervals. To apply poller settings,
click ReApply Polling Intervals.
Default Node Poll Interval
Devices are regularly polled to determine status and response time on this
designated interval. By default, this interval is 120 seconds.
Default Volume Poll Interval
Volumes are regularly polled to determine status and response time on this
designated interval. By default, this interval is 120 seconds.
Default Rediscovery Interval
Your entire network is polled on this interval to detect any re-indexed
devices. Monitored network devices are also checked for IOS upgrades
permitting EnergyWise support. By default, this interval is 30 minutes.
Lock custom values
311
Network
The following settings configure ICMP and SNMP requests.
ICMP Timeout
All ICMP (ping) requests made by the SolarWinds poller time out if a
response is not received within the period designated. By default, this
period is 2500ms.
ICMP Data
This string is included within all ICMP packets sent by SolarWinds.
SNMP Timeout
All SNMP requests made by the SolarWinds poller time out if a response is
not received within the period designated. By default, this period is 2500ms.
SNMP Retries
If a response to an SNMP poll request made by the SolarWinds poller is not
received within the configured SNMP Timeout, the SolarWinds poller will
conduct as many retries as designated by this value. By default, this value is
2.
312
313
Node Status:
Node Status:
The default method is based upon the historical up or down status of the selected
node. The selected node is polled for status on the Default Node Poll Interval
defined on the SolarWinds Polling Settings view. For more information, see
SolarWinds Polling Settings.
If the selected node responds to a ping within the default interval, the node is
considered up, and a value of 100 is recorded in the Response Time table of the
Orion database. If the node does not respond to a ping within the default interval,
the node is considered down and a value of 0 is recorded in the Response Time
table of the Orion database. To calculate node availability over a selected time
period, the sum of all Response Time table records for the selected node over the
selected time period is divided by the selected time period, providing an average
availability over the selected time period.
Percent Packet Loss:
The second method is a more complicated calculation that effectively bases the
availability of a selected node on its packet loss percentage. As in the Node
Status method, the selected node is polled for status. If it responds within the
Default Node Poll Interval defined on the SolarWinds Polling Settings view, a
value of 100 is averaged with the previous 10 availability records. For more
information, see SolarWinds Polling Settings.
The result of the Percent Packet Loss calculation is a sliding-window average. To
calculate node availability over a selected time period, the sum of all results in the
Response Time table for the selected node over the selected time period is
divided by the selected time period, providing an average availability over time.
Note: The Percent Packet Loss method introduces a historical dependency into
each availability node record. In general, it is best to leave calculations based on
Node Status unless you specifically need node availability based on packet loss.
Calculating a Baseline
Much of the raw data that SolarWinds SAM polls from nodes is provided initially
as counter values. If you do not need statistics immediately, or if you do not want
SolarWinds SAM to calculate a baseline at startup, disable baseline calculation
at startup by setting the Baseline Calculation option on the SolarWinds Polling
Settings view to False. For more information, see Configuring Polling Engine
Settings.
314
If these or any other conditions present the need for reassignment, complete the
following procedure to reassign nodes to a new polling engine.
To reassign nodes to a different polling engine:
1. Click Start> All Programs> SolarWinds > Advanced Features>
SolarWinds Service Manager.
2. Click Shutdown Everything.
Note: Confirm that you stop the SolarWinds Network Performance Monitor
Service on all polling engines.
3. Click Start> All Programs> SolarWinds > Advanced Features> Monitor Polling Engines.
4. Click Servers> Poller Load Balancing.
5. Select the nodes you want to reassign.
Note: Use Shift+click to highlight multiple consecutive rows, and use
Ctrl+click to highlight multiple non-consecutive rows.
6. Click Polling Engines> Move Selected Nodes to *, substituting the target
polling engine for *. The node is reassigned, and it reflects the name of the
polling engine in the polling engine column.
7. Click Start> All Programs> SolarWinds > Advanced Features>
SolarWinds Service Manager to restart SolarWinds services.
315
316
317
Chapter 12:
Virtualization
SolarWinds Integrated Virtual Infrastructure Monitoring (IVIM) built into
SolarWinds SAM lets you monitor today's modern network fabric of virtual
networks, virtualized data centers, and private clouds. The deep visibility into your
virtualized environments helps you ensure that network performance helps and
not hinders your virtualization projects
SAM is capable of monitoring VMware ESXi and ESX Servers versions 3.5 and
higher as well as Microsoft's Hyper-V up to and including Hyper-V 2012 R2.
Note: A node can either be a VMware ESX/vCenter server or Hyper-V server, not
both.
VMware Monitoring
Monitor your entire VMware virtual infrastructure from the highest to the lowest
level: vCenter datacenter cluster ESX hosts individual virtual
318
Description
SNMP
319
VMware API
VMware Tools
The following table provides a summary of the methods used by SolarWinds SAM
to monitor VMware ESX Servers.
Notes:
l
Both SAM and NPM share the same VIM module, so their monitoring methods are identical.
VIM gathers Network utilization information via VMware API, but not individual interfaces (e.g. Interfaces under List Resources) or interface status
(Up/Down). Interface status is only available via SNMP, which is part of
NPM.
320
3.5
3i
4i
5i
SNMP
Interfaces
CPU
Memory
Total Memory
VMware API
Guest VM List
VMware API
321
322
3. Locate the rocommunity setting and replace the default community string
public with an appropriate read-only community string for your
environment.
Note: Use commas to separate multiple community strings.
4. Save snmpd.conf, and then close your editor.
Note: If you are using nano, press Ctrl+X to close nano, and then enter Y
to save snmpd.conf.
5. Enter chkconfig snmpd on to enable SNMP when you reboot your ESX
Server.
6. Enter esxcfg-firewall -e snmpd to allow SNMP through the ESX Server
firewall.
7. Enter service snmpd start to start the SNMP service.
8. Confirm that SNMP polling is enabled on your ESX Server by entering the
following command:
snmpwalk -v1 -c cstring localhost .1.3.6.1.4.1.6876 | grep 6876.1
Note: Replace cstring with the community string you provided above.
9. After entering the snmpwalk command, your ESX Server should return
information similar to the following:
323
3. Locate the communities tag, and then replace the default community
string public with an appropriate read-only community string for your
environment.
Note: Use commas to separate multiple community strings.
4. Locate the enable tag, and then confirm it is set to true.
5. Locate the port tag and confirm it is set to 171.
6. Locate the targets tag and confirm it is set to 127.0.0.1@162/cstring.
Note: Replace cstring with the community string you provided above.
7. Save snmp.xml, and then close your editor.
324
325
6.
7.
8.
9.
10.
11.
a. Provide both a Login and a User Name for the SolarWinds SAM
polling engine.
b. Enter and confirm a Password.
c. Click OK.
Open the Permissions tab.
Right-click the Permissions view, and then click Add Permission.
On the Assign Permissions window, click Add.
Select the user you just created, and then click Add.
Click OK on the Select Users and Groups window.
Select an appropriate role in the Assigned Role area, and then click OK on
the Assign Permissions window.
The credential you have created is now available to use for monitoring your ESX
Server. For more information about adding your ESX Server to the Orion
database for monitoring, see Managing VMware Credentials in the Web Console.
326
327
Virtualization Summary
Virtualization Summary
The Virtualization Summary view shows the overall status of your virtualized
infrastructure.
To view the Virtualization Summary:
1. Log in to the SolarWinds Web Console.
2. Point to the Virtualization tab and then click Virtualization Summary.
The Virtualization Summary view is pre-configured to display the following
resources:
Top XX Hosts by CPU Load
VMware Assets
Hyper-V Assets
To change the properties or contents of any resource, click Edit in the resource
box.
Availability Statistics
Event Summary
Node Details
Polling Details
328
If the ESX server returns the message, Unable to establish session with all
provided credentials, check the following:
l
l
329
Hyper-V Monitoring
Hyper-V Monitoring
SAM natively supports monitoring of Microsoft's Hyper-V server and its guests.
By default, the statistic collection interval is set to ten minutes.
Note: A node can either be a VMware ESX/vCenter server or Hyper-V server, not
both.
Description
Hyper-V version
WMI
330
SolarWinds recommends
fewer than 1,000 virtual
machines running on any one
Hyper-V server.
Need
User
Account
331
If you have restricted the range of dynamic RPC ports, you must ensure that
each host is able to access that port range.
If you are connecting to Hyper-V hosts through a DMZ or hardware firewall,
you must open the corresponding rules and ports on the hardware.
To allow the correct traffic through the Windows firewall, you must perform the
following steps:
1. Ensure the core networking rules are enabled
2. Enable the Windows Management Instrumentation (DCOM-In) rule
3. Create a new rule to open the RPC ports
Ensure the Core Networking rules are enabled
You must ensure that the core networking rules are enabled to collect information
successfully from Hyper-V hosts.
Note: If the rule has a green icon with a checkmark in front of it, the rule is
enabled.
To allow core networking traffic through the Windows Firewall on Windows
2008 R2:
1. Log on to the computer you want to monitor with an administrator account.
2. Navigate to Start> Administrative Tools>Windows Firewall with
Advanced Security.
3. Click Inbound Rules in the left navigation pane.
4. Ensure that all Core Networking rules are enabled. If not, select the disabled rule and then click Enable Rule in the Action menu.
Enable the Windows Management Instrumentation (DCOM-In) rule
You must ensure that the Windows Management Instrumentation (DCOM-In)
rule is enabled to collect information successfully from Hyper-V hosts.
Note: After enabling the Windows Management Instrumentation (DCOM-In) rule,
common WMI checks indicate that WMI is not enabled. This is expected behavior.
332
333
334
335
Virtualization Assets:
Virtualization Assets:
With Hyper-V being native to SAM, you can drill down to the Node Details page
from this view. If the node in this view is not managed, you will be prompted to go
to the Add Node wizard to have this node managed.
Clicking Edit will allow you to filter the vendors that are shown in this view.
336
Chapter 13:
Building Component Monitors and
Templates
The following diagram illustrates the work flow involved in creating an application
to be monitored by SolarWinds Server & Application Monitor.
337
338
l
l
l
339
If every node uses unique private keys, then editing the application after it
has been assigned is the best option. Use method A.
If most or all of your nodes use the same private key, then you should edit
the credentials directly in the template. Use method B.
5. From here, you can select one or more Linux/Unix/Nagios script component
monitors to edit by checking the boxes to the left of each monitor and then
clicking Multi-Edit.
6. Check the Authentication Type box and select Username and PrivateKey
from the drop down menu.
7. Check the Credential for Monitoring box and select the credentials you
want to use from the drop down menu, and then click Save.
B.) Editing a Template Directly:
1. Select the template you want to edit.
2. Change the Authentication Type option to Username and PrivateKey for
each component monitor that should use this authentication type.
3. From the Credential for Monitoring field drop down menu, select the credentials you want to use with your monitors, and then click Submit.
340
Adding credentials to the Credentials Library for use later. See the section
Adding Credentials to the Credentials Library.
Creating credentials on the spot (Quick Credentials) when editing templates
and component monitors. See the section Using Quick Credentials.
Editing credentials. See the section Editing Credentials in the Credentials
Library.
Deleting credentials. See the section Deleting Credentials from the Credentials Library.
db_owner
db_accessadmin
db_securityadmin
db_ddladmin
db_datareader
db_datawriter
db_backupoperator
Important:
l
341
l
l
SolarWinds Server & Application Monitor uses the same SNMP credentials
that you entered during node discovery. There is no need to specify additional credentials for SNMP operations.
SolarWinds SAM stores credentials encrypted in the database.
The ability to Inherit Windows credentials from node is available in the
drop down list.
342
343
Application Discovery
Add Application Monitors
Editing an Assigned Application Monitor
Unmanaging Assigned Application Monitors
Remanaging Assigned Application Monitors
Deleting Assigned Application Monitors
344
345
346
Inheriting Thresholds
Automatic Calculation of Baseline Data
Applying Baseline Thresholds at the Template Level
Applying Baseline Thresholds at the Application Level
Latest Baseline Details
Understanding Latest Baseline Details
Understanding Sustained Thresholds
Inheriting Thresholds
Thresholds can be adjusted at the template level or on the individual component
monitor level of an application.
347
348
${Threshold.Warning.DisplayName}
${Threshold.Critical.DisplayName}
349
350
3. If selecting only one component monitor, click [+] to expand the monitor
details.
a. Click Use Latest Baseline Thresholds, as shown:
Note: Once this box is checked, the Warning and Critical fields will
automatically populate with the macro, ${USE_BASELINE}.
b. Select the options for sustained thresholds, if desired:
Note: For more information, see Understanding Sustained
Thresholds.
351
352
4. If selecting only one Component Monitor, click [+] to expand the monitor
details.
a. Click Override Template.
Note: The current values for the thresholds will appear in the Warning and Critical fields
b. Click Use Latest Baseline Thresholds, as shown:
c. When applied, the values will change and a blue icon will appear
indicating that baseline thresholds are being used.
5. If selecting more than one component monitor, use the check boxes to
select the monitors you want to edit, and then click Multi-Edit.
a. Click Multi-Edit.
Note: Multi-Edit will only become available when the selected
353
Note: Once the second box is checked, the Warning and Critical
fields will automatically populate with the macro, ${USE_BASELINE}.
For more information, see "Understanding Latest Baseline Details"
on page 355.
c. Click Save.
6. When done, click Submit.
For more information, see Understanding Sustained Thresholds.
354
4. Find a component monitor in the list and click [+] to expand the monitor
details.
5. Click Override Template.
6. Click Latest Baseline Details.
355
Note: Clicking Use Recommended Thresholds will not affect the chart.
Understanding the Occurrences Chart
The horizontal (X) axis displays the range of values collected by the current
component monitor during the data collection period. The vertical (Y) axis
displays the frequency of each value collected during the data collection period.
The three colors of the chart show the values of the component monitor during
different time periods: Day, Night, and All Hours. You can show or hide these
time periods by checking and un-checking their respective boxes in the legend.
You can have the chart show a specific time range by dragging the mouse over a
small area of the chart. Hovering over any area of the chart will provide a tooltip
with detailed information about that area of the chart.
356
The yellow and red shading of the chart indicates the recommended Warning and
Critical thresholds, respectively. These shaded areas are taken from the values
recorded in the Latest Baseline Statistics table.
Note: The ability to check and un-check the boxes in the legend is for visual
purposes only and will not affect the values generated for calculated thresholds.
Understanding the Metric Over Time Chart
The horizontal (X) axis displays the time period for when the values were
collected for the current component monitor. The vertical (Y) axis displays the
range of all the values collected during the charted time.
In other words, the light blue bars show the range of values for the statistics
collected during the charted time period. The bottom of the bars indicates the
lowest statistic collected, or the minimum. The top of the bars indicates the
highest statistic collected, or the maximum. The blue line of the chart shows the
average values of the component monitor through time.
Using the legend, you can show or hide these statistics by checking and unchecking their respective boxes.
You can have the chart show a specific time range by dragging the mouse over a
small area of the chart or by using the sliders located at the bottom of the chart.
Hovering over any area of the chart will provide a tooltip with detailed information
about that area of the chart.
357
The yellow and red of the chart indicates the recommended Warning and Critical
thresholds, respectively. These shaded areas are taken from the values recorded
in the Latest Baseline Statistics table.
Note: The ability to check and un-check the boxes in the legend is for visual
purposes only and will not affect the values generated for calculated thresholds.
Understanding the Latest Baseline Statistics Table
Along with the minimum and maximum values displayed, the Latest Baseline
Statistics table at the bottom of the display shows the average baseline statistics
surrounded by three levels of standard deviation for both day and night data. This
table highlights the recommended Warning and Critical thresholds in yellow and
red, respectively.
In addition to using the recommended threshold values, you can hover the mouse
over any value in the table to bring up a tooltip dialog. The tooltip dialog allows
you to visualize, but not change, the value for the Warning or Critical threshold to
the value you are hovering over by simply clicking either link in the dialog.
Visualizing a value in this way will affect the chart above the table by
repositioning the shading indicating the Warning and Critical threshold areas.
358
In the Current Thresholds Settings area, you can manually change the values for
both the Warning and Critical thresholds, or use the recommended values by
clicking Use Recommended Thresholds.
Additionally, you can add logic for these thresholds by selecting an operator from
the drop down list such as Greater Than, Less Than, Equal To, and so on. The
logical operator selected will apply to both the Warning and Critical thresholds
and cannot be separated. For example, if you select the Greater Than or Equal
to operator with a Warning threshold value of 80 and a Critical threshold of 90,
the thresholds will be considered met if the returned value for the current
performance counter meets or exceeds 80 for Warning or 90 for Critical.
359
360
361
362
363
364
365
366
367
JSON
JSONis accepted in the HTTPmonitor and HTTPS monitor, as shown below.
Following is an example of JSONcode:
{
"firstname": "Kate"
"lastname": "Asaff"
"age" : 29
"city" : "Austin"
}
Notes:
l
l
HTTP Monitor
HTTPS Monitor
368
SOAP Monitor
SOAP Monitor
This page provides general information concerning the SOAPmonitor and how it
works. For information concerning the individual fields of the SOAPmonitor, see
SOAP Component Monitor.
Note: Currently, the SOAPmonitor within SAMcan return a status of either Up or
Down, or return a status of Warning or Critical based on response time
thresholds. This monitor also has the ability to search for the presence of a string.
Definitions:
l
369
370
371
372
373
l
l
For general information about the settings for each component monitor, click the
More Information help link in the SolarWinds SAM component monitor
description.
Note: SolarWinds fully supports scripts written and provided by the company;
however, we do not provide customer support for custom scripts written by outside
sources. SolarWinds does provide sample scripts that we do support located at:
C:\Program Files\SolarWinds\Orion\APM\Sample-Script Monitors.
For information on using Data Transformations, refer to the following sections:
l
l
Conversion Value
Available Data Transformations
374
376
Linux/Unix Scripts
Linux/Unix Scripts
Linux/Unix scripts are uploaded by SSH and then run on the target node using
the string from the Command Line field.
You can use the following variable in the command line field:
${SCRIPT}
Replaced with the script body.
You can use the following variables in the script body field:
${IP}
Replaced with the target nodes IP address.
${USER}
Replaced with the user name from the credential.
${PASSWORD}
Replaced with the password from the credential.
Example Scripts
There are several sample scripts installed with SolarWinds SAM you can use to
create Linux/Unix script component monitors. These sample scripts are installed
on your SolarWinds SAM server, in the folder:
C:\ProgramFiles\SolarWinds\Orion\APM\SampleScriptMonitors\LinuxScript
s
Scripts Must Report Status Through Exit Codes
Scripts must report their status by exiting with the appropriate exit code:
Exit Code
Meaning
Up
377
Down
Warning
Critical
For example, if you want to inform SolarWinds SAM that a Script reports Up
status, you would exit the script using code similar to the following, where 0
reports Up:
Wscript.quit(0)
Scripts with Text Output
Scripts report additional details by sending text to the scripts standard output.
In APM 4.0.2 and earlier, each line of output contained a single detail in the
following format:
DetailType:Value
# Script output comment
Message: The directory contains too many files.
Statistic: 5
While this is still true, SAM now supports multiple values returned by a script
using the following format.
Statistic.Name1: xMessage.Name1: abc
Statistic.Name2: yMessage.Name2: abc
Detail
Type
Required Meaning
Statistic
Yes
378
Message No
There is a limit of ten Statistic and Message pairs for the script. These can
be placed anywhere in the script output. The Statistic and Message names
you give must contain valid letters and/or numbers.
Note: A maximum of 10 output pairs can be returned. If you have exceeded the
maximum allowed, remove the excess output pairs or they will simply be ignored.
Sample output:
# Script comment: This shows two pairs. Ten pairs are possible.
Statistic.CPU: 31.08
Message.CPU: svchost.exe cpu usage
Statistic.RAM: 1234.56
Message.RAM: svchost.exe ram usage
For information on creating a Nagios Script Monitor, see " Creating a Nagios
Script Monitor" on page 386.
379
VBScript
.vbs
Installed by default
380
Field Descriptions
JScript
.js
Installed by default
PerlScript
.pls
Freeware
ooRexxScript
.rxs
Freeware
PythonScript
.pys
Freeware
TclScript
.tcls
Freeware
ActivePHPScript
.phps
Freeware
RubyScript
.rbs
Freeware
Commercial
Commercial
Note: VBscript runs locally on the SAM server only. PowerShell uses
WINRM that runs over TCP ports5985 and 5986. All Linux, Unix, and
Nagios script monitors use SSH over TCP Port 22.
Roll-Up
This option allows you to choose how you would like the monitor to report
the returned results based on the output provided by the script. With the
ability to have multiple values returned, selecting how your scripts report
back to you offers more flexibility. The default selection is Show worst
status. For more information, see Managing the Display of Group Status on
page 291.
Script
This field allows you to enter the script you want to run on the target node.
To enter your script, click the Edit button that reveals the script editing
window.
Script Arguments
This field is in the script editing window and allows you to specify
arguments to pass to the script. You may include the variables ${IP},
${USER}, and ${PASSWORD}, which are replaced respectively by the IP
address of the target node, the credential user name, and the credential
password.
Body
381
382
Meaning
Up
Down
Warning
Critical
For example, if you want to inform SolarWinds SAM that a VBScript reports Up
status, you would exit the script using code similar to the following, where 0
reports Up:
Wscript.quit(0)
383
Required Meaning
Statistic
Yes
Message No
There is a limit of ten Statistic and Message pairs for the script. These can be
placed anywhere in the script output. The Statistic and Message names you give
must contain valid letters and/or numbers.
Sample output:
# Script comment: This shows two pairs. Ten pairs are possible.
Statistic.CPU: 31.08Message.CPU: svchost.exe cpu usage
Statistic.RAM: 1234.56Message.RAM: svchost.exe ram usage
Example Scripts
Below is a sample vbscript that returns two values; the total number of files in a
folder, and twice the total number of files in the same folder. The code that
represents these two values are bold, To use this script, copy and paste the
384
Example Scripts
following code into the Script Body field. In the Scripts Arguments field, type in
C:\Windows, or any other folder you want to monitor.
Option Explicit
On Error Resume Next
Dim lstArgs, path, fso, objDir, objFiles, objFiles2
Set lstArgs = WScript.Arguments
If lstArgs.Count = 1 Then
path = Trim(lstArgs(0 ))
Else
WScript.Echo "Message: Usage: wscript.exe filelist.vbs [pathToFiles]"
&vbCRLF &"[pathToFiles] Local or UNC Path"
WScript.Echo "Statistic: 0"
WScript.Echo "Message: Usage: wscript.exe filelist.vbs [pathToFiles]"
&vbCRLF &"[pathToFiles] Local or UNC Path"
WScript.Echo "Statistic: 0"
WScript.Quit(1 )
End If
Set fso = Wscript.CreateObject("Scripting.FileSystemObject" )
If fso.FolderExists(path ) Then
Set objDir = fso.GetFolder(path )
If(IsEmpty(objDir ) = True ) Then
WScript.Echo "Message: Object Not Initialized"
WScript.Echo "Statistic: 0"
WScript.Quit(1 )
End If
Set objFiles = objDir.Files
If(IsEmpty(objFiles ) = true) Then
WScript.Echo "Message: Object Not Initialized"
WScript.Echo "Statistic: 0"
WScript.Quit(1 )
End If
385
386
Field Descriptions
OK
Up
Warning
Up or Down/Unreachable
Critical
Down/Unreachable
Unknown
Down/Unreachable
___________________
If the Use Aggressive Host Checking option is enabled, return codes of 1 will result in a host
state of DOWN, otherwise return codes of 1 will result in a host state of UP.
Your Nagios script must exit with a valid return code and a line of text output. The
exit code determines the status of the component. If the exit code is 0 (OK), the
component status may be further modified by thresholds from the optional
statistics. To return up to ten optional statistics, separate the statistics from the
status message with the pipe (|) symbol using the following syntax:
statusMessage [|'statisticName'=value]
Below is an example of valid output with a status message and two statistics:
The script ran. | 'CPU%'=75.2 'MemoryRemainingInKB'=600784
Statistic
The statistic for this component monitor is the value returned by the script. For
more information, see http://nagios.sourceforge.net/docs/3_0/pluginapi.html.
Field Descriptions
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
This describes the type of monitor you are using.
Enable Component
387
388
389
7.
8.
9.
10.
11.
12.
390
391
392
Select Nodes
Click [+] in the list to expand the node groups and to select the nodes you want to
scan.
Select Applications
To keep the time it takes to scan to a minimum, we recommend you initially scan
for only a limited number of application templates. To see more application
templates, select a different template group from the Show Only list.
To adjust the template assignment criteria, expand Advanced Scan Settings
and move the slider to the desired setting:
Exact Match
All the components must match to assign the template.
Strong Match
Most of the components must match to assign the template.
Partial Match
Some of the components must match to assign the template.
Minimal Match
At least one component must match to assign the template.
393
394
11.
12.
13.
14.
395
396
Managing Templates
5. Select the component monitor type that you want to browse, then click
Next.
6. Type the IP address of the node you want to browse, or click Browse and
select the node from the list.
7. If suitable credentials already exist, choose the credential from the
Choose Credential list.
8. If suitable credentials do not exist, choose <New Credential> from the
Choose Credential list, and then add the new credential by filling out the
credential details.
9. Click Next.
10. If you selected a performance counter monitor type, select a performance object from Performance Object to populate the list.
11. Check the check boxes next to one or more found items to add as a component monitor.
12. Click Next.
13. Configure the component monitor properties, and then click Next.
Note: You can specify the name of a specific process to monitor by
entering the name in the Process Name field.
14. Select New Application Monitor Template.
15. Type a name for your template in the Application Monitor Template
Name field.
16. Click Next.
17. If you want to assign the template to nodes, select the nodes.
18. If you only want to create the template, do not select any nodes.
19. Click Next, and then click OK, Create.
Managing Templates
You can create a new template or manage existing templates by using the
commands on the SAM Settings page:
l
l
l
l
l
l
l
Creating Templates
Assign to Node
Editing Templates
Copying Views
Exporting and Importing Templates Locally or Using Thwack
Deleting Templates
Tagging Templates
397
See Creating New Templates Using the Traditional Method for information on
completing the new template.
Assign to Node
You can create an assigned Application Monitor by assigning template(s) to
nodes.
To create an assigned Application Monitor by assigning template(s) to
nodes:
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
398
Editing Templates
Editing Templates
You can modify an existing template by adding or removing its component
monitors. You can then save it to a new template by changing the template name
if desired.
To edit an application template:
1.
2.
3.
4.
5.
6.
Multi-Edit Templates
Multiple component monitors within a template can be edited simultaneously. As
indicated by the toolbar, multiple monitors can be selected to: Assign
Credentials, Test, Set Test Node, Disable, and Delete. The monitors selected
399
Once the Multi-Edit button is pressed, a pop-up window is dispalyed with editing
options specific to the type of monitor selected. For example, the Fetching Method
for the three Services selected can be changed from RPC to WMI, as shown
below:
Note: Different types of monitors will have different options available for editing.
Ordering Components
Beginning in SAM 5.5, you now have the ability to re-order the components within
a template. When editing a template, the green arrows to the right of each
component monitor, highlighted below, will allow you to change the order of each
monitor. This new order is respected only on the All Applications resource and
the Application Details resource.
400
Copying Templates
Copying Templates
After successfully creating a complicated template, instead of having to recreate it
over for a similar application, consider copying the template. This will allow you to
only modify those properties that differ.
To copy an application template:
1.
2.
3.
4.
5.
401
402
Deleting Templates
5. Check the template(s) you want to import, and then click Import. Then enter
your thwack User Name and Password and click Log In.
6. A dialog is displayed informing you that the import operation was successful. Click Close to close the dialog or click View Imported Templates
to view the results.
Note: If you import a template with the same name as one of your existing
templates, the name of the imported template is modified by appending (n)
to the name, where n is an integer. For example, assume you save the template named Tomcat Server Template (shipped with SAM) to a file. If you
then import the saved template Tomcat Server Template from the file, the
imported template is renamed as Tomcat Server Template (1). If you
import the same template again, the next imported template is named Tomcat Server Template (2), and so on. This renaming protects you from accidentally overwriting an existing template.
Deleting Templates
If you no longer need a template, you can delete it. Deleting a template also
deletes all the data associated with it, so ensure you no longer need either the
template or the associated data before deleting the template.
Notes:
l Deleting a template also deletes all of its assigned applications, both modified and unmodified.
l To speed user interface interaction, data is not immediately removed from
the database, but systematically updated every few minutes in the background.
To delete a template:
1.
2.
3.
4.
5.
6.
Tagging Templates
Tags are descriptive labels that help you classify and sort your application
templates on the Manage Application Monitor Templates page. The application
templates included in SolarWinds SAM have already been tagged with several
descriptive labels you can modify as you see fit.
403
404
405
406
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
407
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
408
409
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
410
TCP port component monitor to monitor port 1433, the port through which
SolarWinds communicates with the SQL Server.
Service component monitors for the following windows services:
l SolarWinds Alerting Engine
l SolarWinds Network Performance Monitor
l SolarWinds Job Engine
l SolarWinds Job Scheduler
l SolarWinds Module Engine
l SolarWinds Syslog Service
l SolarWinds Trap Service
HTTP component monitor to monitor port 80, the port through which you access
the SolarWinds Web Console.
To create a SolarWinds SAM application template:
1.
2.
3.
4.
5.
411
412
413
9. Expand the folders by clicking the arrows (or [+]) to expand the tree view
folder structure. From here you can drill down to select the attributes you
want by checking them.
10. Click Next.
Now you are able to edit the JMX Component Monitor properties.
l
l
414
Data
Transformation
Syntax
Definition
Eulers Number
E()
Pi
Pi()
Rounding
Round({value},
{number of
decimal places})
Truncate
Truncate({value},
{number of
decimal places})
Square Root
Sqrt({value})
Exponentiation
Pow({base
Provides the result from repeated
value}, {exponent multiplication of the base number.
value})
Temperature:
Celsiusto
Fahrenheit
CToF({value})
Temperature:
Fahrenheitto
Celsius
FToC({value})
XtoKilobyte
XToKilo({value})
415
XtoMegabyte
XToMega
({value})
XtoGigabyte
XToGiga({value})
XtoTerabyte
XToTera({value})
Kilobyteto
Megabyte
KiloToMega
({value})
Kilobyteto
Gigabyte
KiloToGiga
({value})
Kilobyteto
Terabyte
KiloToTera
({value})
Megabyteto
Gigabyte
MegaToGiga
({value})
Megabyteto
Terabyte
MegaToTera
({value})
Gigabyteto
Terabyte
GigaToTera
({value})
Terabyte to
Kilobyte
TeraToKilo
({value})
Terabyte to
Megabyte
TeraToMega
({value})
Terabyte to
Gigabyte
TeraToGiga
({value})
Conversion Value
Some monitors now offer the option to mathematically convert returned values
through the use of Data Transformations.
416
Conversion Value
Checking the Convert Value check box opens the Formula box that enables you
to perform various mathematical functions. You can choose common functions
from the drop down lists to manipulate the returned value, or you can select the
Custom Conversion option.
The Custom Conversion option offers more flexibility when manipulating
returned values. This option allows you to use the basic arithmetic operators; +, -,
*, /, along with built-in functions for more advanced conversions.
For a list of these functions, see Available Data Transformations" on page 414.
Following is a real world example for converting bytes into megabytes using a
predefined formula, or data transformation. In this case, XtoMega, was used to
convert bytes to megabytes.
With the XtoMega formula applied, the data transforms from 318767104 bytes to
304 megabytes, which is much easier to read.
Note: The Retrieve Current Value button tests the application and does not
apply the data transformation. Instead, the original statistic value will be returned.
417
Chapter 14:
Asset Inventory
The Asset Inventory dashboard allows you to maintain a current and detailed
inventory of your environment's hardware and software. Automatic inventory data
collection will benefit those interested in tracking asset depreciation, gathering
information for insurance purposes, or managing and maintaining your
infrastructure.
The following resources are available for the Asset Inventory dashboard:
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
Note: Certain information may not be available for certain nodes. This may be
due to the polling method used or a lack of data provided by the manufacturer.
For additional information on Asset Inventory, see:
l
l
418
l
l
l
l
l
l
The Asset Inventory feature supports the following operating systems and
protocols and does not count against your SAM component monitor license.
Additionally, these nodes must be managed by SAM to enable collection of Asset
Inventory data:
Operating System
Protocol
Windows
SNMP, WMI
Linux
SNMP
SNMP
l
l
l
CIM
VMware API
SNMP for VMware nodes not polled
via CIM or the VMware API
HTTPS
419
HP/VMWare
l
l
l
HP Management Agents for VMware ESX 4.x Only (Not for ESXi 4.x)
HP Insight Management WBEM Providers for ESXi 5.0
HP ESXi Offline Bundle for VMware ESXi 5.0
Dell/VMWare
l
IBM
l
VMWare
l
l
l
l
HP Management Agents for VMware ESX 4.x Only (Not for ESXi 4.x)
HP Insight Management WBEM Providers for ESXi 5.0
HP ESXi Offline Bundle for VMware ESXi 5.0
Dell OpenManage Support for VMware ESXi 5.x
420
3. Click Submit.
421
Note: The option to display Asset Inventory information may not be available if the node does not have a supported operating system.
To Disable Asset Inventory Data Collection:
l
For existing nodes, you can disable Asset Inventory data collection by
executing the following SQL command:
UPDATE [SolarWindsOrion].[dbo].[AssetInventory_Polling] set Enabled
= 0;
To disable this for future nodes added, rename the following file:
C:\Program Files (x86)
\SolarWinds\Orion\Discovery\Plugins\SolarWinds.AssetInventory.Disc
overy.plugin
422
423
Drivers
l
l
l
l
Drivers
This resource displays driver software currently installed on the current node
while providing a search window. The data can be sorted by clicking the headers
of each column.
424
l
l
l
l
l
Firmware
This resource displays the firmware currently installed on the current node while
providing a search window. The data can be sorted by clicking the headers of
each column.
l
l
l
l
425
Hard Drives
Hard Drives
This resource provides information about the current hard drives associated with
the node.
l
l
l
426
l
l
l
l
l
For more information, see "Hardware Monitoring and VMware" on page 1077.
Logical Volumes
This resource provides detailed information about the current logical volumes
associated with the node. Volumes call be polled via all protocols except VMware
CIM for ESX hosts. Any logical volume that can be monitored by SolarWinds will
appear in this resource.
427
Memory
l
l
l
l
l
l
l
Memory
This resource provides detailed information about the memory associated with
the node.
Memory Summary
l
l
l
Total RAM: Displays the total amount of RAM on the current node.
Free RAM: Displays the total amount of free RAM on the current node.
Total Virtual Memory: Displays the total amount of virtual RAM on the current node.
Free Virtual Memory: Displays the total amount of free virtual RAM on the
current node.
428
Slot: Displays the slot number in the server where memory is installed.
SAM also shows empty slots that could be populated with additional
memory modules to increase the server's RAM.
Capacity: Displays the maximum available RAM installed in the current
memory slot, in megabytes.
Model: Displays the model part number which can be used for purchasing a
replacement part.
Speed: Displays the frequency on which the memory module runs, in megahertz.
Network Interfaces
This resource provides detailed information about current network interfaces
associated with the node.
l
l
l
Name: Displays the name and model of the listed interface. For more information about a network interface, click [+] to the left of the interface name to
expand the tree view and reveal the following information:
l NetMask: Displays the configured netmask.
l Gateway: Displays the address of the gateway.
l DHCP Server: Displays the address of the DHCP server.
l DNS Server: Displays the address of the DNS server.
Manufacturer: Displays the manufacturer of the listed interface.
MAC Address: Displays the MAC address of the listed interface.
IP Address: Displays the IP address of the listed interface.
429
l
l
l
Name: Displays the name of the listed update. Clicking the name in this
field may take you to the website with information concerning the listed
update.
Type: Displays the type of update installed.
Install Date: Displays the date that the listed update was installed.
Installed By: Displays the user responsible for installing the listed update.
l
l
l
l
l
Peripherals
This resource provides information about the current peripherals associated with
the node.
430
l
l
Ports
l
l
USB Controllers
l
USB Controllers: Displays detailed information about the listed USB controller.
Processors
This resource provides detailed information about the processors associated with
the node.
Notes:
l
Some IBM nodes may not provide processor information which will result in
missing information from this resource.
If a monitored computer is running the Solaris operating system, processor
information will not be available in this resource.
431
Removable Media
Important: Data for the number of cores will not be available for computers
running Windows Server 2003 unless the following Microsoft hotfix is applied:
http://support.microsoft.com/kb/932370.
l
l
l
l
l
l
Removable Media
This resource provides information about the current removable media associated
with the node.
l
l
l
Software Inventory
This resource displays software currently installed on the current node while
providing a search window.
432
l
l
l
l
Storage Controllers
This resource provides detailed information about the current storage controllers
associated with the node. The data can be sorted by clicking the headers of each
column.
l
l
l
l
System Information
This resource provides a general overview of the selected node. To update the
details of this resource, click Poll Now, which forces all Asset Inventory
information to be polled immediately. To navigate to the Node Details page of the
current node, click the name of the node in the System Name field.
433
General
l
l
l
l
Last Inventory Collection: The date when SAM last collected inventory
data on the selected node.
System Name: Name of the current node.
Host Name: Name of the current host. This only applies to Windows hosts
polled via WMI
Domain/Workgroup Name: Name of the domain or workgroup this node
belongs to.
DNS: This is the DNS name of the current node. The IP address of the node
can change while the DNS name remains the same.
Domain Role: Shows the role of the current node. This only applies to Windows hosts polled via WMI
IP Address: Shows the IP address of the current node.
Dynamic IP: Shows if the current IP address is dynamic or static.
Hardware
l
l
l
l
434
l
l
Serial Number/Service Tag: Shows the serial number of the current node.
This only applies to physical nodes.
Warranty Status: Shows the warranty information about the current node
with a link to that vendor's site. This only applies to physical servers that are
Dell, HP, or IBM.
Note: One alert is included for Warranty Status:
l Alert me when a node warranty expires in 30 days - Disabled by
default.
Location: Displays the geographical location of the current node.
Device Time Zone: Shows the time zone set in the system. This only
applies to Windows nodes polled via WMI.
Operating System
l
l
l
l
l
435
436
Chapter 15:
AppInsight Applications
AppInsight applications provide a level of detail and expert knowledge far beyond
what a simple template can provide, allowing you to monitor virtually every aspect
of the assigned application.
Like any unassigned application in SAM, AppInsight applications are considered
templates until applied. Therefore, it is a member of the Application Monitor
Templates collection.
Once applied to a node, AppInsight applications are considered applications.
Like any SAM application, AppInsight applications are comprised of multiple
component monitors, also known as performance counters.
Currently, SAMoffers two different AppInsight Applications:
l
l
l
Template/Application Relationship
The following illustration explains the Template and Application relationship and
is true for all templates, including all AppInsight applications.
Here you can see that if you change something at the template level, the
applications based on that template will be affected. Conversely, if you change
something on the application level, only the individual application will be affected.
This inheritance relationship is beneficial if you need to make a great deal of
changes quickly. For example, rather than change one item on 100 applications
that are based on a single template (which requires 100 changes), you can more
easily change the one item on the template. That one change in the template will
trickle down to all 100 applications that are based on the template.
437
438
439
AppInsight for SQL Details view, which is comprised of the following subviews:
l AppInsight for SQL Details View (Summary Tab)
l AppInsight for SQL Details View (Queries Tab)
l Database Details View
Performance Counter Details View
_________________
Portions of the performance counter information used in the AppInsight for SQL application are provided courtesy of
multiple sources listed in the copyright and attribution section at the beginning of this document.
440
Without SP
SP1
SP2
SP3
Without SP
SP1
SP2
Without SP
SP1
Notes:
l
AppInsight for SQL supports both the SNMP and WMI protocols and uses
SQL to gather information about the application. Additional information is
available for nodes managed via WMI.
Agents do not work with AppInsight for SQL when the SQL server being
monitored is in a cluster.
Important: This following scripts make changes directly to the database. You
should create a database backup before running either of these scripts.
441
The following script will configure permissions for a SQL account with
Windows Authentication:
USE master
GRANT VIEW SERVER STATE TO "Domain\AppInsightUser"
GRANT VIEW ANY DEFINITION TO "Domain\AppInsightUser"
EXEC sp_adduser @loginame = 'Domain\AppInsightUser' ,@name_in_
db = 'Domain\AppInsightUser'
GRANT EXECUTE ON xp_readerrorlog TO "Domain\AppInsightUser"
USE msdb
EXEC sp_adduser @loginame = 'Domain\AppInsightUser' ,@name_in_
db = 'Domain\AppInsightUser'
EXEC sp_addrolemember N'db_datareader',
N'Domain\AppInsightUser'
EXECUTE sp_MSforeachdb 'USE [?]; EXEC sp_adduser @loginame =
''Domain\AppInsightUser'', @name_in_db =
''Domain\AppInsightUser'''
442
443
2. Fill out the information on the Define Node step, and then click Next.
3. On the Choose Resources step, check the AppInsight for SQL applications you want. AppInsight applications have a unique blue and white
icon, as shown. when done, click Submit:
444
445
446
447
Setting Properties
At this point, you can begin editing the properties of the node being added.
To change the name:
1. At the top of the form, change the name to the instance you are going to be
monitoring, as shown:
448
WMI: http://www.solarwinds.com/documentation/apm/docs/APMWMITroubleshooting.pdf
SNMP: http://knowledgebase.solarwinds.com/kb/questions/314/Troubleshooting+SNMP+connectivity
Troubleshooting
449
450
Editing Resources
Database Details View - This view displays details about the selected database.
Performance Counter Details View - This view displays details about the
selected performance counter.
From here, you can select from the drop down menu and choose to display
different amounts of data based on a time range, as shown below:
Editing Resources
Both the titles and subtitles of each resource can be changed by clicking Edit in
the upper right-hand corner of any resource, and then clicking Submit.
The time and date displayed at the top of each resource (where applicable)
shows the range of data currently loaded into the resource. This, along with the
Sample Interval Range, can be changed by clicking Edit from within the resource.
Additionally, certain resources will allow you to add and remove component
monitors from the resource. You can do this by clicking the Edit button, and then
checking the component monitors you want to keep.
451
452
453
454
455
456
4. Make sure that the node with this address is being monitored by SAM. If it is
not, add it.
Note: If the IP address represents a cluster, the node name of the active
cluster member will be populated. It is recommended that you change the
node name to something more easily understood, for example: P111SQLV23
457
5. Enter the proper information and manually assign the Appinsight for SQL
template to the node with the appropriate IP address.
6. The application should begin polling.
For more information, see How to Handle Microsoft Server Clusters in AppInsight
for SQL
To View Alerts:
458
2. Select the alerts you want to view from the list, or type a keyword in the text
box and click the Search button:
l
l
l
l
All Databases
Application Availability
Application Details
Buffer Manager
Cache
459
l
l
l
l
l
l
l
l
l
l
l
l
Connections
Disk
Latches and Locks
Memory
Pages
Sessions
SQL Agent Job Status
SQL Errors
SQL Event Log Message Details
SQL Server
Top 10 Databases by Active User Connections
Top 10 Most Expensive Queries by CPU Time
Note: Chart resources require several values for lines on charts to be visible.
All Databases
This resource shows the status of all monitored databases on the current SQL
instance. The data can be sorted by clicking the headers of each column.
l
l
l
Name: Displays the name of the listed database, in addition to the current
performance status as indicated by the icon. Clicking the name of the database will take you to the Database Details page.
Status: Displays the Online or Offline status of the listed database.
Database Size: Displays the current size of the listed database.
Transaction Log Size: Displays the size of the transaction log associated
with the listed database.
Active Alerts
This resource lists details about all unacknowledged active alerts.
460
Application Availability
Time of Alert: Displays the time and date the listed alert was triggered.
Object Name: Displays the object that triggered the alert. Clicking the
object will take you to the details page for that object.
Message: Displays the message of the listed alert.
Application Availability
This resource graphically shows the various states of an application in a
percentage format and is made up of three sections: the legend, the main chart,
and the lower chart. The colors of the main chart correspond to the labels in the
legend.
Note: This resource will not be available when using Internet Explorer 7.
Consider upgrading Internet Explorer 8 or higher or using FireFox or Chrome as
your web browser.
461
l
l
l
l
l
l
Management: This provides tools allowing you to more easily manage and
troubleshoot the current application.
Instance Name: Displays the name of the current SQL instance.
Status: Displays the status of the current SQL instance.
SQL Server Version: Displays the version of the current SQL server.
SQL Server Product Level: Displays the maturity level of the current SQL
version.
SQL Server Edition: Displays the edition of the current SQL Server.
Clustered with: If the listed SQL Server is in a cluster, this field will show a
listing of the servers that make up the cluster. If the cluster is managed by
SAM, a status icon will become visible. If the cluster is not managed in
SAM, no status icon will be visible.
462
Buffer Manager
Buffer Manager
This resource contains performance counters specific to the current status of
buffers. The icons of the listed performance counters in the Statistic Name column
will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that counter.
If the value of a listed performance counter approaches or crosses the Warning
threshold, a yellow band will appear for the listed counter allowing plotted values
that cross the threshold to easily be visualized against the yellow band. If the
value of a listed performance counter approaches or crosses the Critical
threshold, a red band will appear for the listed counter allowing plotted values that
cross the threshold to easily be visualized against the red band. Hovering over
any time period within the chart will display detailed information about that time
period in the tooltip. Hovering over a counter will give you detailed information
about that performance counter.
Counter
Expert Knowledge
Total
pages
Definition:
This performance counter returns the number of pages in the
buffer pool
Information:
The returned value includes database, free, and stolen pages.
Note: This counter is not available in SQL 2012.
463
Buffer
Cache Hit
Ratio
Definition:
Indicates the percentage of pages found in the buffer cache
without having to read from disk. The ratio is the total number of
cache hits divided by the total number of cache lookups over the
last few thousand page accesses.
Information:
After a long period of time, the ratio moves very little. Because
reading from the cache is much less expensive than reading from
disk, you want this ratio to be high. Generally, you can increase
the buffer cache hit ratio by increasing the amount of memory
available to SQL Server. The higher this ratio, the less often SQL
Server has to go to the hard disk to fetch data, and performance is
boosted overall. This counter averages the Buffer Cache Hit Ratio
from the time the last instance of SQL Server was restarted. This
counter is not a real-time measurement, but an average of all the
days since SQL Server was last restarted. In OLAP applications,
the ratio could be much lower because of the nature of how OLAP
works.
Possible problems:
If the returned value is low, this could indicate that your SQL
server may not have enough memory to function at peak
performance.
Remediation:
Check your SQL server and verify its memory is being used
efficiently. Applications other than SQL may be using a great deal
of memory. Try and recover memory by closing unnecessary
applications. Installing additional memory may also help.
Lazy
Definition:
Writes/sec The lazy writer is a system process that flushes out buffers that
contain changes that must be written back to disk before the
buffer can be reused for a different page and makes them
available to user processes.
Information:
464
Buffer Manager
This counter tracks how many times per second that the Lazy
Writer process is moving dirty pages from the buffer to disk in
order to free up buffer space. The Lazy Writer eliminates the need
to perform frequent checkpoints in order to create available
buffers.
Generally speaking, this should not be a high value, say more
than 20 per second. Ideally, it should be close to zero. If it is zero,
this indicates that your SQL Server's buffer cache is large and
your SQL Server does not need to free up dirty pages.
Possible problems:
If the returned value is high, this can indicate that your SQL
Server's buffer cache is small and that your SQL Server needs to
free up dirty pages.
Remediation:
Check your SQL server and verify its memory is being used
efficiently. Applications other than SQL may be using a great deal
of memory. Try and recover memory by closing unnecessary
applications. Installing additional memory may also help.
Free List
Stalls/sec
Definition:
Indicates the number of requests per second that had to wait for a
free page.
Information:
This displays the frequency with which requests for available
database pages are suspended because no buffers are available.
Possible problems:
If the returned value is high, this indicates that not enough
memory is available for the SQL Server.
Remediation:
Check your SQL server and verify its memory is being used
efficiently. Applications other than SQL may be using a great deal
of memory. Try and recover memory by closing unnecessary
applications. Installing additional memory may also help.
465
466
Cache
Counter
Expert Knowledge
Cache
Definition:
Used/min This displays the number of times the cache object has been
looked up.
Information:
This is not incremented when parameterized queries find a plan in
the cache. However, this can be incremented multiple times when
using Showplan. Good plan reuse is one sign of a healthy system.
Compiling a query plan can be a CPU-intensive operation,
especially with complex queries, so reuse is encouraged.
Possible problems:
If the returned value is low, this can indicate ineffective reusing of
plan cache which could cause a CPU spike. Conversely, if the
returned value is high for a large number of plans, this could
indicate that your cache space is being taken up with plans that
were compiled and used once to execute an ad hoc query, then
never used again.
Remediation:
A database setting that can be helpful to plan reuse is forced
parameterizaton. (You can set this using the following command:
ALTER DATABASE <databaseName> SET
PARAMETERIZATION FORCED). Normally, the query optimizer
is very conservative when deciding what queries can be
parameterized, but this setting makes the optimizer be more liberal
in choosing parameters.
Cache
Object
Counts
Definition:
This performance counter returns the number of cache objects in
the cache.
Information:
ThePlan Cache object provides counters to monitor how SQL
Server uses memory to store objects such as stored procedures,
ad hoc and prepared Transact-SQL statements, and triggers.
Multiple instances of thePlan Cacheobject can be monitored at
467
Definition:
This performance counter returns number of cache objects in use.
Information:
ThePlan Cache object provides counters to monitor how SQL
Server uses memory to store objects such as stored procedures,
ad hoc and prepared Transact-SQL statements, and triggers.
Multiple instances of thePlan Cacheobject can be monitored at
the same time, with each instance representing a different type of
plan to monitor.
Possible problems:
High numbers ofcached objects in use consumethe memory
available to a SQL server at a higher rate than non-active objects
on a per database basis. This can result in one database cache
impacting the performance of other local databases due to memory
contention.
Remediation:
Increase the memory available to SQL server, reduce the number
of active objects, consolidate stored procedures, consolidate and
convert ad hoc queries to stored procedures where possible, or
reduce the number of databases on the server.
Zooming
468
Connections
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Connections
This resource contains monitors specific to the current status of the active
connections. The icons of the listed performance counters in the Statistic Name
column will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that counter.
If the value of a listed performance counter approaches or crosses the Warning
threshold, a yellow band will appear for the listed counter allowing plotted values
that cross the threshold to easily be visualized against the yellow band. If the
value of a listed performance counter approaches or crosses the Critical
threshold, a red band will appear for the listed counter allowing plotted values that
cross the threshold to easily be visualized against the red band. Hovering over
any time period within the chart will display detailed information about that time
period in the tooltip. Hovering over a counter will give you detailed information
about that performance counter.
469
Counter
Expert Knowledge
User
Definition:
Connections The User Connections performance counter identifies the
number of different users that are connected to your SQL
Server at the time the sample was taken.
Information:
You need to watch this counter over time to understand your
baseline user connection numbers. Since each user
connection consumes some memory space, a high number of
user connections can impact throughput and cause a
performance slow-down. Once you have an idea of your high
and low thresholds during normal usage of your system, you
can then look for times when this counter exceeds these high
and low marks.
Possible problems:
If the returned value of this counter goes down and the load on
the system remains stable, you might have a bottleneck that is
not allowing your server to handle the normal load. Keep in
mind that this counter value might go down just because less
people are using your SQL Server instance. If you see this
number jump by 500% from your baseline, you may be seeing
a slowdown of your server activity.
Remediation:
You may want to boost the SQL Server configuration setting,
Maximum Worker Threads to a figure higher than the default
setting of 255. The setting for Maximum Worker Threads
should be higher than the maximum number of user
connections your server ever reaches.
Logins/sec
Definition:
This performance counter returns the total number of logins
started, per second, and does not include pooled connections.
Information:
Opening and closing connections is an expensive process. A
470
Connections
Definition:
This performance counter returns the total number of logout
operations started, per second.
Information:
Opening and closing connections is an expensive process.
When applications do not use a connection pool, each request
needs to establish its own connection before the query can be
executed. It then has to close it. A pooled connection is one
which is kept open by an application for other requests to reuse.
Possible problems:
If the returned value is high, this can indicate that the
application is not correctly using connection pooling.
Remediation:
Review the Connection Polling configuration.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
471
Counter
Expert Knowledge
Average Disk
sec/Read
Definition:
This performance counter shows the average time, in
seconds, of a read of data from the disk.
472
Disk
Information:
The returned value indicates the average time of read data
from the disk. 4-8ms is ideal. The returned value is
considered acceptable up to 20ms. Any higher value needs
further investigation.
Possible problems:
If a value greater than 15-20ms is reported, this may indicate
disk bottlenecks.
Remediation:
Increase the number of hard disks.
Average Disk
sec/Write
Definition:
This performance counter shows the average time, in
seconds, of a write of data to the disk.
Information:
The returned value indicates the average time of write data
from the disk. 4-8ms is ideal. The returned value is
considered acceptable up to 20ms. Any higher value needs
further investigation.
Possible problems:
Values greater than 15-20ms nay indicate disk bottlenecks.
Remediation:
Increase the number of hard disks.
Forwarded
Definition:
Records/Batch This performance counter identifies the use of a pointer
Requests
which has been created when variable length columns have
caused a row to move to a new page in aheap.
Possible problems:
Rows withVarcharcolumns can experience expansion
whenVarcharvalues are updated with a longer string. In the
case where the row cannot fit in the existing page, the row
migrates and access to the row will traverse a pointer. This
473
Definition:
This performance counter returns the number of records
fetched through forwarded record pointers.
Information:
Tables without a clustered index. If you start with a short row,
and update the row creating a wider row, the row might not fit
on the data page. A pointer is put in its location and the row
is forwarded to another page.
Possible problems:
Look at the code to determine where the short row is inserted
followed by an update.
Remediation:
Can be avoided by:
1. Using default values so that an update does not result
in a longer row that is the root cause of forwarded
records.
2. Use Char instead of Varchar. This fixes the length so
that an update does not result in a longer row.
Physical Disk
Time
Definition:
This performance counter returns the ratio of elapsed time
when the disk drive was busy with read or write requests.
Information:
This performance counter is deceptive because it makes no
accommodation for multiple spindles. Thus, the more
spindles (i.e. physical hard disks) you have, the higher the
474
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
475
Counter
Expert Knowledge
Latch
Waits/sec
Definition:
This performance counter displays the number of latch
requests that could not be granted immediately.
Total Latch
Wait
Time/Latch
Waits
Definition:
This performance counter returns the ratio of Total Latch Wait
Time, in milliseconds, for latch requests in the last second to
amount of latches, in a one second period that had to wait.
Latches are lightweight means of holding a very transient
server resource, such as an address in memory.
476
Information:
This ratio should be less than 10. Monitoring the latches to
determine user activity and resource usage can help you to
identify performance bottlenecks.
Possible problems:
If the returned value is high, it is likely there is an I/O or
memory bottleneck.
Remediation:
Check your SQL server and verify its memory is being used
efficiently. Applications other than SQL may be using a great
deal of memory. Try and recover memory by closing
unnecessary applications. Installing additional memory may
also help.
Lock
Definition:
Requests/sec This performance counter returns the number of requests for a
type of lock, per second.
Possible problems:
If the returned value is high, this can indicate that the queries
are accessing large numbers of rows. If you notice a high
Average Wait time, then this could be an indication of
blocking.
Information:
Blocking is an unavoidable characteristic of any relational
database management system (RDBMS) with lock-based
concurrency. On SQL Server, blocking occurs when one
Server Process ID (SPID) holds a lock on a specific resource
and a second SPID attempts to acquire a conflicting lock type
on the same resource. Typically, the time frame for which the
first SPID locks the resource is very small. When it releases
the lock, the second connection is free to acquire its own lock
on the resource and continue processing. This is normal
behavior and may happen many times throughout the course
of a day with no noticeable effect on system performance.
477
Remediation:
High Read queries should be reviewed. The simple way to fix
locking is just kill the connection that is causing the lock.
Fixing locking, blocking, and deadlocking issues is often a
matter of redesign. You should examine either the schema of
your database and/or the way the application is designed.
One of the most efficient ways to deal with locking is to ensure
that the design of your system does not have to deal with
excessive locks. The best way to do this is to normalize your
tables, using more atomic structures that allow the query to get
in and get out faster. Another method is to code with the locks
in mind. If the design requires less normalization, you will
have to evaluate the programs to ensure that they have the
right isolation levels.
Lock
Waits/sec
Definition:
This performance counter reports the number of times users
waited to acquire a lock over the past second.
Information:
Note that this counter only gets incremented only when you
wake up after waiting on the lock.
Possible problems:
Non-zero values indicate that there is at least some level of
blocking occurring. If you combine this with the Lock Wait
Time counter, you can get some idea of how long the blocking
lasted. A zero value for this counter can definitively rule out
blocking as a potential cause.
Remediation:
High Read queries should be reviewed.
Lock
Timeouts/sec
Definition:
This performance counter returns the number of lock requests
per second that have timed out, including internal requests for
NoWait locks.
478
Information (timeout_period):
This is the number of milliseconds that will pass before
Microsoft SQL Server returns a locking error. A value of -1
(default) indicates no time-out period (that is, wait forever).
When a wait for a lock exceeds the time-out value, an error is
returned. A value of 0 means to not wait at all and return a
message as soon as a lock is encountered.
Possible problems:
If you see a value above 0 for this counter, your users will
experience problems as their queries are not completing.
Remediation:
You should review your queries to determine which queries
are causing this situation.
Lock Wait
Time
Definition:
This performance counter displays the total time spent waiting
across all transactions, in milliseconds, to acquire a lock in the
last second.
Information:
Though this counts how many milliseconds SQL Server is
waiting on locks during the last second, this counter actually
starts recording at the end of locking event. Peaks most likely
represent one large locking event.
Possible problems:
If the returned value is greater than 60 seconds (60,000ms)
then there may be extended blocking which could be an
issue.
Remediation:
Thoroughly analyze the blocking script output. Some
applications are written for timing out after 60 seconds.
Because SQL Server records a lock at the end of a locking
event, remember that an application with large transactions
may have inflated lock wait times while still performing as
479
expected. For example, an application that issues multimillion record updates might have very long lock wait times
while performing exactly as it was designed.
Average
Latch
Wait Time
Definition:
This performance counter reports the average latch wait time,
in milliseconds, for latch requests that had to wait.
Information:
SQL Server two lightweight mutual exclusion solutions
Latches and Spinlockswhich are less robust than locks but
are less resource intensive. The value of this counter should
generally correlate to Latch Waits/sec and move up or down
with it accordingly.
Possible problems:
If you see this number jump above 300, you may have
contention for your server's resources. High values for this
counter could potentially block other users.
Remediation:
You should examine tasks currently waiting using the
following command: sys.dm_os_waiting_tasks DMV.
Average
Lock Wait
Time
Definition:
This performance counter reports the average amount of Wait
time, in milliseconds, for each lock request that resulted in a
wait.
Information:
Generally speaking, the lower the value, the better. This value
should correlate to theLock Waits/seccounter and move up or
down with it accordingly.
Possible problems:
An average wait time longer than 500ms may indicate
excessiveblocking.
Remediation:
You should determine which queries are generating locks to
480
Memory
Definition:
Total latch wait time (in milliseconds) for latch requests in the
last second.
Information:
Short term light weight synchronization object. Latches are not
held for the duration of a transaction. Typical latching
operations during row transfers to memory, controlling
modifications to row offset table, and so on.
Possible problems:
If high, check Perfmon Disk and Memory objects for:
l
l
I/O bottlenecks
Memory pressure
Remediation:
This can be mitigated by adding more memory or I/O capacity.
Zooming:
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Memory
This resource displays the current status of SQL Server memory. The icons of the
listed performance counters in the Statistic Name column will change color to
reflect the listed counter's current state. Clicking any performance counter in the
Statistic Name column will take you to the Performance Counter Details page for
that counter.
481
Counter
Expert Knowledge
Total Server
Memory
Definition:
This performance counter measures the current amount of
memory that SQL Server is using.
Information:
If the value of this counter continues to grow larger, the server
has not yet reached its steady state and is still trying to populate
the cache and get pages loaded into memory. Performance will
likely be somewhat slower if this value continually grows larger
since more disk I/O is required. This behavior is normal.
Eventually Total Server Memory should approximate Target
Server Memory.
Possible problems:
482
Memory
Definition:
This monitor measures the total amount of dynamic memory the
server can consume.
Information:
This performance counter tells you how much memory SQL
Server would like to use to operate efficiently. Compare with
Total Server Memory.
Possible problems:
If the Total Server Memory counter is greater than or equal to
the Target Server Memory counter, this could indicate that your
SQL Server may be under memory pressure.
Remediation:
Installing additional memory into your SQL server should
resolve the problem.
Definition:
This performance counter shows the difference between the
total amount of dynamic memory the server can consume and
the current amount of memory that SQL Server is using.
Possible problems:
If this performance counter is greater than or equal to the Target
Server Memory performance counter, this indicates that SQL
Server may be under memory pressure.
Remediation:
Installing additional memory into SQL server should resolve the
problem.
483
SQL Cache
Memory
(KB)
Definition:
This performance counter measures the total amount of
dynamic memory the server is using for the Dynamic SQL
cache.
Information:
Most memory used by SQL Server is allocated to the Buffer
Pool, which is used to store data pages. SQL Server steals a
proportion of this memory for use in caching query plans. The
overall amount of memory available to SQL Server depends
upon the amount of memory installed on the server, the
architecture of the server, the version and edition of SQL Server
and the amount of memory pressure being experienced by SQL
Server. This pressure can be internal (SQL Server resources
need memory) or external (operating system needs memory).
SQL Server is designed to respond to memory pressure when
necessary.
Possible problems:
Memory contention with the buffer pool.
Remediation:
Increase memory available to SQL server.
Lock
Memory
Definition:
This performance counter returns the total amount of dynamic
memory the server is using for locks.
Information:
Lock pages in memoryis used to prevent older versions of
Windows and SQL from allowing Windows operating
systempage out of the buffer pool.
Possible problems:
Lock pages in memorydetermines which accounts can use a
process to keep data in physical memory, which prevents the
system from paging the data to virtual memory on disk.
Exercising this privilege could significantly affect system
performance by decreasing the amount of available random
484
Memory
Definition:
This performance counter returns the total amount of memory
currently granted to executing processes, such as Hash, Sort,
Bulk Copy, and Index creation operations.
Information:
This performance counter tells you how much memory has
currently been granted to running queries. If there is memory
pressure because of workspace memory, this value should be
at least 25% of the virtual memory available to SQLServer.
Possible problems:
If the memory pressure is severe, the server might return errors
such as 701 or 8645.
Remediation:
If this is the case, this might be a good reason to consider using
SQL Server 64-bit.
Optimizer
Memory
Definition:
This performance counter returns the total amount of dynamic
memory the server is using for query optimization.
Information:
There are no thresholds associated with this performance
counter.
Connection
Memory
Definition:
This monitor returns the total amount of dynamic memory the
server is using for maintaining connections.
Information:
485
SQL Server sets aside three packet buffers for every connection
made from a client. Each buffer is sized according to the default
network packet size specified by the sp_configure stored
procedure. If the default network packet size is less than 8KB,
the memory for these packets comes from SQL Server's buffer
pool. If it is 8KB or larger, the memory is allocated from SQL
Server's MemToLeave region. It is worth noting that the default
network packet size for the .NET Framework Data Provider for
SQL Server is 8KB, so the buffers associated with managed
code client connections typically come from SQL Server's
MemToLeave region. This contrasts with classic ADO
applications, where the default packet size is 4KB, and the
buffers are allocated form the SQL Server buffer pool.
Memory
Grants
Pending
Definition:
This monitor returns the total number of processes waiting for a
workspace memory grant.
Information:
Memory resources are required for each user request. If
sufficient memory is not available, the user waits until there is
adequate memory for the query to run.
Possible problems:
Returned values greater than zero for a sustained period of time
is a very strong indicator of memory pressure.
Remediation:
You should first examine the database design, queries, and
indexes to ensure the system is properly tuned before installing
additional RAM. There may be query inefficiencies in the
instance that is causing excessive memory grant requirements.
For example, large Sorts or Hashes that can be resolved by
tuning the indexing or queries being executed.
Compare with Memory Grants Outstanding. If the number of
pending grants increases, try the following:
l
l
486
Memory
Memory
Definition:
Grants
This performance counter returns the total number of processes
Outstanding that have successfully acquired a workspace memory grant.
Information:
Look at Memory Grants Outstanding and Memory Grants
Pending. If you see a long queue of pending grants as
compared to outstanding grants, there is likely memory
pressure because of query workspace memory. You can
confirm this by checking the Granted Workspace Memory (KB)
performance counter that tells you how much memory has
currently been granted to running queries.
Possible problems:
A returned value that is high can indicate peak user activity. If
there is memory pressure because of workspace memory, this
value should be at least 25% of the virtual memory available to
SQLServer. If the memory pressure is severe, the server might
even return errors such as 701 or 8645.
Remediation:
If severe, and using 32-bit, consider using SQL Server 64-bit.
See Memory Grants Pending.
Pages/sec
Definition:
This performance counter displays the rate at which pages are
read from or written to disk to resolve hard page faults.
Information:
This is a primary indicator of the kinds of faults that cause
system-wide delays. This should be close to zero on a
dedicated SQL Server. You will see spikes during backups and
restores, but this is normal.
Possible problems:
High values causes hard page faults, which can cause SQL
487
Definition:
This metric is the ratio between Cache Hits and Lookups.
Cache Hit Ratio measures how much theplan cacheis being
used.
Information:
A high percentage here means that your SQL Server is not
building a new plan for every query it is executing and is
working effectively and efficiently. A low percentage here
means that, for some reason, the SQL Server is doing more
work than it needs to. This metric needs to be considered
alongside theplan cachereuse metric which looks at the
spread of plan reuse through your cache.
Plan cacheis memory used to store objects such as stored
procedures, ad hoc and preparedTransact-SQLstatements,
and triggers. Theplan cacheis the component of SQL memory
that stores query plans for re-use. When a query is issued
against SQL, the optimizer will attempt to re-use a cached plan
if the traits of the query permit - but can only do so if that plan
resides in cache, otherwise it needs to compile a new plan.
This is not to say that every plan that is cached is re-used.
Changes in schema, a query running parallel that may have run
serially before, or changes in parameters may require a new
plan to be compiled even if a similar plan exists in cache. Plan
compilations are expensive though. Ideally this counter should
be near 100%.
Possible problems:
The value of this counter should never fall below 90%. Low
cache hit ratio (<20%) along with a sustained query execution
rate (Batch Requests/sec) indicates that compiled plans are not
being re-used. It should be noted that the hit ratio counter may
be skewed by internal lookups performed.
488
Memory
Remediation:
The amount of caching should be reduced by examining the
workload to see if queries have beenparameterized, or can be
rewritten with stored procedures.
Available
MBytes
Definition:
This is the amount of available physical memory on the server.
Information:
An acceptable output for this may vary widely based on how
much physical memory is in the machine. If you have 2GB of
RAM installed on the machine, it is common to see SQL Server
use 1.7GB of RAM. If no other processes are running on your
SQL Server, ensure you have at least 80MB available for
Windows at any given time.
Possible problems:
Low values show that SQL server has lack of memory.
Remediation:
Install additional memory.
Page Usage
Definition:
This shows the percentage of the page file that is being utilized.
Information:
A Page File is simply a file on the hard drive that handles
situations where the system wants to move or page out
sections of memory. There are several situations that cause
this, but the one you should be most concerned about is when
the system is out of physical memory.
Possible problems:
Values greater than 70 percent indicate paging and lack of
memory. If the system runs out of memory it can borrow some
storage from the hard drive to release some memory until it
needs that data again. The reason that this is bad is because
hard drives are amazingly slow in comparison with solid-state
memory access. Using the page file slows SQL Server a great
489
deal.
Remediation:
Install additional memory.
Workfiles
Created/sec
Definition:
This is the number of work files created per second.
Information:
For example, work files could be used to store temporary
results for hash joins and hash aggregates. The returned value
should be less than 20. Tempdb work files are used in
processing hash operations when the amount of data being
processed is too large to fit into the available memory.
Possible problems:
High values can indicate thrash in the tempdb file as well as
poorly coded queries.
Remediation:
It is possible to reduce the value this monitor returns by making
queries more efficient by adding/changing indexes. Adding
additional memory will also help.
Worktables
Created/sec
Definition:
This performance counter displays the number of work tables
created per second.
Information:
For example, work tables could be used to store temporary
results for query spool, lob variables, XML variables, and
cursors. The returned value should be less than 20. Worktables
are used for queries that use various spools (table spool, index
spool, and so on).
Possible problems:
High values could cause general slowdown.
Remediation:
Remediation requires rewriting your procedures.
490
Pages
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Pages
This resource shows page status of the SQL server.
In SQL Server, the page size is 8 KB. Therefore, SQL Server databases have 128
pages per MB. Each page starts with a 96 byte header that stores information
about the page. This information includes the page number, page type, the
amount of free space on the page, and the allocation unit ID of the object that
owns the page.
The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.
If the value of a listed performance counter approaches or crosses the Warning
threshold, a yellow band will appear for the listed counter allowing plotted values
that cross the threshold to easily be visualized against the yellow band. If the
value of a listed performance counter approaches or crosses the Critical
threshold, a red band will appear for the listed counter allowing plotted values that
cross the threshold to easily be visualized against the red band. Hovering over
any time period within the chart will display detailed information about that time
period in the tooltip. Hovering over a counter will give you detailed information
about that performance counter.
491
Counter
Expert Knowledge
Page
Definition:
Lookups/sec: This performance counter returns the number of requests to
find a page in the buffer pool.
Information:
(Page lookups/sec) / (Batch Requests/sec) > 100.
Possible problems:
When the ratio of page lookups to batch requests is much
greater than 100, this is an indication that while query plans
are looking up data in the buffer pool, these plans are
inefficient.
Remediation:
Identify queries with the highest amount of logical I/O's and
tune them.
Page
Reads/sec
Definition:
This performance counter returns the number of physical
database page reads issued.
Information:
80 90 physical database page reads per second is normal.
Possible problems:
Returned values that are high could indicate indexing or
memory constraint.
492
Pages
Remediation:
Attempt to tune the application so that fewer I/O operations are
required. For example, perhaps I/O operations would be
reduced if there were the appropriate indexes, or if the
database design were de-normalized. If the applications
cannot be tuned, you will need to acquire disk devices with
more capacity. Because physical I/O operations are
expensive, you may be able to minimize the cost either by
using a larger data cache, intelligent indexes, more efficient
queries, or by changing the database design.
Page
Lookups/
Batch
Request
Definition:
This performance counter displays the number of page splits
per second that occur as the result of overflowing index
pages.
Information:
(Page lookups/sec) / (Batch Requests/sec) > 100.
Possible problems:
When the ratio of page lookups to batch requests is much
greater than 100, this is an indication that while query plans
are looking up data in the buffer pool, these plans are
inefficient.
Remediation:
Identify queries with the highest amount of logical I/O's and
tune them.
Page
Writes/sec
Definition:
This performance counter returns the number of physical
database page writes issued.
Information:
80 90 physical database page writes per second is normal.
Possible problems:
If the returned values are high, you should check the Lazy
Writer/sec monitor.
493
Page
Faults/sec
Definition:
This performance counter returns the average number
ofpages faultedper second.
Information:
This performance counter gives an idea of how many times
information being requested is not where the application
expects it to be. The information must either be retrieved from
another location in memory or from the pagefile. While a
sustained value may indicate trouble, you should be more
concerned with hard page faults that represent actual reads or
writes to the disk. Disk access is much slower than RAM.
Possible problems:
Any measurement higher than zero delays response time and
probably indicates that more RAM is needed.
Remediation:
Add additional memory to your SQL server.
Page
Splits/Batch
Request
Definition:
This performance counter displays the number of page splits
per second that occur as the result of overflowing index
pages.
Information:
The returned value needs to be low as possible.
Possible problems:
High values could mean poor table or index design.
Remediation:
If the number of page splits is high, consider increasing the
Fill Factor of your indexes. An increased Fill Factor helps to
reduce page splits because there is more room in data pages
before it fills up and a page split has to occur. Note that this
counter also includes the new page allocations as well and
does not necessarily pose a problem. The other place we can
confirm the page splits that involve data or index rows moves
are the fragmented indexes on page splits.
494
Pages
Page
Splits/sec
Definition:
This performance counter returns the number of page splits
per second.
Information:
The returned value for this monitor should be as low as
possible.
Possible problems:
Returned values that are high can indicate the overflowing of
index pages. A high value for this counter is not bad in
situations where many new pages are being created, since it
includes new page allocations.
Remediation:
To avoid Page Splits, review the table and index design so as
to reduce non-sequential inserts. You can also implement
Fillfactor and Pad_Index to leave more empty space per page.
Page Life
Expectancy
Definition:
This performance counter returns the number of seconds a
page will stay in the buffer pool without references.
Information:
This performance monitor reports, on average, how long data
pages are staying in the buffer.
Possible problems:
If this value gets below 300 seconds, this is a potential
indication that your SQL Server could use more memory in
order to boost performance. Consistently having pages that
stay in memory for less than that amount of time may indicate
the need for more memory.
Remediation:
Add additional memory to your SQL server.
Database
Pages
495
Information:
The higher the buffer managerDatabase Pagesis, the less
room there is for SQL Server to cache more data pages. This
means that SQL Server may have to free up data cache pages
order to make room for pages being moved in from disk to the
data cache, which can increase disk IO and hurt performance.
There are no specific thresholds for this counter as each
server is different. Instead, watch baseline values and look for
sudden changes in the baseline value.
Possible problems:
If the value for this performance counter increases above its
typical baseline value, this may indicate memory pressure for
the SQL Server instance.
Remediation:
Investigate buffer management and disk I/O.
Free Memory
Note: This
performance
counter is only
available in
SQL Server
2012.
Definition:
The amount of memory available for SQL Server to use.
Information:
When SQL Server is using memory dynamically, it queries the
system periodically to determine the amount of free memory.
Maintaining this free memory prevents the operating system
(OS) from paging. If less memory is free, SQL Server releases
memory to the OS. If more memory is free, SQL Server may
allocate more memory. SQL Server adds memory only when
its workload requires more memory; a server at rest does not
increase the size of its virtual address space. The returned
value should be as high as possible.
Possible problems:
If Resource Semaphore does not find enough free memory,
then it puts the current query into the waiting queue.
Remediation:
l
l
Increase RAM
Increase SQL Servers Max Server Memory
496
Free Pages
Definition:
This performance counter displays the total number of pages
on all free lists.
Information:
This is not main indicator of memory problems and could only
used as signal of possible memory pressure.
Possible problems:
If this performance counter is critical and other memory
counters are good, it is possible that there are no problems
with memory.
Remediation:
Check other memory counters. If they have critical values, you
may try to install additional memory into SQL server.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Processes and Services
This resource provides detailed information about the active processes and
services associated with the database selected. Hovering over a component will
give you detailed information about that component.
497
l
l
l
Sessions
This resource displays the current number of sessions.
Sessions include both connections and internal background processes like ghost
cleanup , checkpoint, and so on. There is a close correlation between
connections and sessions, but they are not necessarily the same.
The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.
If the value of a listed performance counter approaches or crosses the Warning
threshold, a yellow band will appear for the listed counter allowing plotted values
that cross the threshold to easily be visualized against the yellow band. If the
value of a listed performance counter approaches or crosses the Critical
threshold, a red band will appear for the listed counter allowing plotted values that
cross the threshold to easily be visualized against the red band. Hovering over
any time period within the chart will display detailed information about that time
period in the tooltip. Hovering over a counter will give you detailed information
about that performance counter.
498
Sessions
Counter
Expert Knowledge
Active
Definition:
Sessions A current connection that is actively processing.
Information:
To find information about an active session, Use Sp_Who2 Active
or Sys.Dm_Exec_Sessions (Available in SQL 2005 or greater).
Possible problems:
Blocking session.
Remediation:
Wait until blocking clears or kill the session. If killed, the process
would roll back changes. If there are many changes, it could take a
while to roll-back.
Inactive
Definition:
Sessions A current connection that is not currently processing.
Information:
To find information about an inactive sessions, use Sp_Who2.
Possible problems:
Blocking session.
499
Remediation:
Kill the session if blocking a process needs to finish. If killed, the
process would roll back changes. If there are many changes, it
could take a while to roll-back.
System
Definition:
Sessions A System initiated connection.
Information:
Normally these numbers are less than 50.
Possible problems:
Blocking session.
Remediation:
Do not kill system sessions.
User
Definition:
Sessions A user initiated connection.
Information:
Normally these numbers are greater than 50.
Possible problems:
Blocking session.
Remediation:
Kill the session if blocking a process needs to finish. If killed, the
process will roll back changes. If there are many changes, it could
take a while to roll-back.
Zooming:
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
500
l
l
l
l
SQL Agent Job information is used to provide metrics for this resource and cannot
be edited.
SQL Errors
This resource displays SQL events that have occurred on the current SQL
instance. The data can be sorted by clicking the headers of each column.
501
l
l
Date/Time: Displays the date and time that the error occurred.
Error Message: Displays the error message that occurred at the listed date
and time.
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, Last Page, Number
of Items to Display on the Current Page, as shown:
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, and Last Page.
Clicking any event message in the list will open a new window, displaying the
entire message, as shown below:
502
SQL Server
SQL Server
This resource shows the status of SQL server counters that warrant a view
independent of grouped resources.
The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.
If the value of a listed performance counter approaches or crosses the Warning
threshold, a yellow band will appear for the listed counter allowing plotted values
that cross the threshold to easily be visualized against the yellow band. If the
value of a listed performance counter approaches or crosses the Critical
threshold, a red band will appear for the listed counter allowing plotted values that
cross the threshold to easily be visualized against the red band. Hovering over
any time period within the chart will display detailed information about that time
period in the tooltip. Hovering over a counter will give you detailed information
about that performance counter.
503
Counter
Expert Knowledge
Batch
Requests/sec
Definition:
This performance counter returns the number of Batch
Requests that SQL Server receives per second.
Information:
The values this monitor returns generally follows in step
as to how busy your server's CPUs are. From a network
bottleneck approach, a typical 100Mbs network card is
only able to handle about 3,000 batch requests per
second.
Possible problems:
Generally speaking, over 1,000 batch requests per
second indicates a very busy SQL Server. If this is the
case, you may soon experience a CPU bottleneck, if
you are not already. Of course, this is a relative number,
and the more powerful your hardware, the more batch
requests per second your SQL Server can handle.
Sometimes low Batch Requests/Sec can be
misleading. If there were a SQL Statements/sec
counter, this would be a more accurate measure of the
amount of SQL Server activity. For example, an
application may call only a few stored procedures, yet
each stored procedure does a great deal of work. In this
case, we will see a low number for Batch Requests/sec,
but each stored procedure (one batch) will execute
many SQL statements that drive up CPU and other
resources. As a result, many counter thresholds based
on the number of Batch Requests/sec will seem to
identify issues because the batch requests on such a
server are unusually low for the level of activity on the
server.
Remediation:
Check your SQL server and verify system resources are
being used efficiently. Applications other than SQL may
504
SQL Server
Definition:
This performance counter returns the number of times
per second that SQL Server compilations have
occurred.
Information:
This value should be as low as possible.
Possible problems:
If you see a high value, say above 100, then this can be
an indication that there are a great deal of ad hoc
queries that are running which may cause increased
CPU usage.
Remediation:
Re-write the running ad hoc queries as stored
procedures or use the following command: sp_
executeSQL.
SQL
Definition:
Recompilations/sec This performance counter returns the number of SQL
statement recompiles that are triggered per second.
Information:
When an execution plan is invalidated due to some
significant event, SQL Server will re-compile it. Recompiles, like compiles, are expensive operations so
you want to minimize the number of re-compiles. Ideally
you want to keep this counter less than 10% of the
number of Compilations/Sec. In other words, keep this
value as low a possible.
In SQL Server 2000, when SQL Server recompiles a
stored procedure, the entire stored procedure is
505
506
SQL Server
507
Auto-Param
Attempts/sec:
asIfstatements.
Run Database Engine Tuning Advisor (DTA) to
see if any indexing changes improve the compile
time and the execution time of the query.
Check to see if the stored procedure was created
with theWith Recompileoption or if
theRecompilequery hint was used. If a procedure was created with theWith
Recompileoption, in SQL Server 2005 SP3, you
may be able to take advantage of the statement
levelRecompilehint if a particular statement
within that procedure needs to be recompiled.
This would avoid the necessity of recompiling the
whole procedure each time it executes, while at
the same time allowing the individual statement to
be compiled.
Definition:
This monitor returns the number of autoparameterization attempts per second.
Information:
The total for this monitor should be the sum of the
failed, safe, and unsafe auto-parameterizations. Autoparameterization occurs when an instance of SQL
Server tries to parameterize a Transact-SQL request by
replacing some literals with parameters so that reuse of
the resulting cached execution plan across multiple
similar-looking requests is possible. Note that autoparameterizations are also known as simple
parameterizations in newer versions of SQL Server.
This counter does not include forced parameterizations.
Possible problems:
Bad T-SQL coding practices can increase
recompilation frequency and adversely affect SQL
Server's performance. Such situations can be
debugged and corrected in many cases.
508
SQL Server
Longest
Transaction
Running Time
Definition:
The performance counter displays the length of time, in
seconds, the transaction that has been running the
longest, has been active.
Information:
Transactions that run longer than others use more
resources. They can be used to track down procedures
and calls that are taking longer than expected by
identifying the specific transaction(s).
Possible problems:
Long running transactions can prevent truncation of
transaction logs. This can cause the transaction log
files to grow until they consume all available physical
disk space shutting down access to the database.
Remediation:
Check the functionality of the query and/or redesign the
long running transaction.
Failed AutoParams/sec
Definition:
This monitor returns the number of failed autoparameterization attempts per second.
Information:
The value returned by this monitor should be low. Note
that auto-parameterizations are also known as simple
parameterizations in later versions of SQL Server.
Preferred values should be near zero.
Possible problems:
Bad T-SQL coding practices can increase
recompilation frequency and adversely affect SQL
Server's performance. Such situations can be
debugged and corrected in many cases.
Full Scans/sec
Definition:
This performance counter returns the number of Full
Scans on base tables or indexes.
509
Information:
This is the number of unrestricted full scans per second.
These can be either base-table or full-index scans.
Possible problems:
Values greater than 1 or 2 indicate table/Index page
scans are occurring. If the CPU is running high, you
should investigate the cause as related to this counter
measurement. You can rule this out as a problem if the
full scans are on small tables.
Remediation:
Following are a few of the main causes of high Full
Scans/sec:
l
l
Range Scans/sec
Missing indexes
Too many rows requested; Queries with missing
indexes or too many rows requested will have a
large number of logical reads and an increased
CPU time.
Scans are IO-intensive and should run within your
databases minimally. Identify the tables that have
a large number of scans against them. Review the
fill factor you have set up on your indexes and minimize it where appropriate.
Definition:
This performance counter returns the number of
Qualified Range Scans through indexes per second.
Information:
This monitor returns the number of qualified range
scans through indexes per second.
Plan Re-Use
Definition:
A query plan is used to execute a query.
Information:
Plan re-use is desirable forOLTPworkloads because
re-creating the same plan (for similar or identical
510
SQL Server
Definition:
This performance counter returns the number of Probe
Scans, per second, that are used to find at most, one
single qualified row in an index or base table directly.
Information:
There are no thresholds associated with this
performance counter.
Recompilations/
Compilations
Definition:
This performance counter shows the ratio of SQL
Recompilations to SQL Compilations.
Information:
SQL Recompilations should be less than 10% of SQL
Compilations.
Possible problems:
Returned values that are high can indicate more
temporary tables in use.
Remediation:
Change stored procedures to not change schemas,
Use table variables instead of temporary tables
Compilations/
Definition:
Recompilations/sec Monitoring the number of query compilations and
511
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
512
513
Query Text: The text shown is a preview of the full query. To view an entire
query in the list, click [+] next to the query listed to expand and view the
query.
Note: Clicking any listed query will take you to the Most Expensive Queries
resource on the Queries tab, providing greater detail about the query.
514
CPU Time: Display the time, in milliseconds, the listed query took to complete.
Database: Displays the database with which the listed query is associated.
The icon in this column shows the current state of the listed database.
The performance counter, Top Expensive Queries, is used to provide metrics for
this resource and cannot be edited.
515
l
l
l
l
l
l
l
l
l
l
Query Text: The text shown is a preview of the full query. To view an entire
query in the list, click [+] next to the query listed to expand and view the
query.
SPID: Server Process ID of the listed query.
Plan Count: Displays the number of cached query plans for the listed
query. A large number might indicate a need for explicit query parameterization.
Executions: Displays the number of times the listed query was executed.
CPU Time: Displays the amount of time, in milliseconds, that the listed
query took to complete.
Phys. Read: This field returns the number of physical reads. Physical reads
are reads that require reading directly from disk. Physical reads are substantially slower than reading from the cache or from RAM.
Logical Reads: Displays the number of times data was read from the
cache.
Logical Writes: Displays the number of times data was written to the cache.
Average Duration: This displays the length of time it took, in milliseconds,
to execute the listed query averaged by the number of executions.
Bytes Transferred: Number of bytes transferred during the query.
Login: Displays the current login information for the listed database.
Host: Displays the host for the listed database.
Database: Displays the current name for the listed database. Clicking any
database in the list will take you to the Database Details page.
516
l
l
Login: This displays the login information for the listed user connection.
Host: This displays the type of host associated with the listed user connection.
Connection Duration: This displays the length of time the listed user connection has been connected.
Idle Time: This displays the length of time the listed user connection has
been idle.
Bytes Transferred: This displays the number of bytes transferred for the listed user connection.
517
Counter
Expert Knowledge
User
Definition:
Connections The User Connections performance counter identifies the
number of different users that are connected to your SQL
Server at the time the sample was taken.
Information:
You need to watch this performance counter over time to
518
Connections
Definition:
This performance counter returns the total number of logins
started, per second, and does not include pooled connections.
Information:
Opening and closing connections is an expensive process. A
pooled connection is one which is kept open by an application
for other requests to re-use.
Possible problems:
If the returned value is high, this can indicate that the
application is not correctly using connection pooling.
Remediation:
519
Definition:
This performance counter returns the total number of logout
operations started, per second.
Information:
Opening and closing connections is an expensive process.
When applications do not use a connection pool, each request
needs to establish its own connection before the query can be
executed. It then has to close it. A pooled connection is one
which is kept open by an application for other requests to reuse.
Possible problems:
If the returned value is high, this can indicate that the
application is not correctly using connection pooling.
Remediation:
Review the Connection Polling configuration.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Database Availability
This resource graphically shows the various states of availability for the current
database in a percentage format. This chart is made up of three sections: the
legend, the main chart, and the lower chart. The colors of the main chart
correspond to the labels in the legend.
520
Zooming
Clicking the Edit button will allow you to change the default zoom range, the
amount of historical data loaded, and set the sample interval time period, as well
as reveal the Advanced section. Expanding the Advanced section will allow you
to change the defaults of the titles from macros to anything you want.
Zooming
You can have the chart show a predetermined, hourly time period of data by
clicking on any one of the three Zoom buttons; 1h, 12h, or 24h. Alternatively, you
can have the chart show a specific time range by dragging the mouse over a
small area of the chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.
Moving the mouse over the main chart will reveal a tooltip with more detailed
information about the specific time period the mouse is hovering over.
521
l
l
l
522
l
l
The performance counter, Database Files, is used to provide metrics for this
resource. It is used in combination with volume polling. This counter is not listed
in the resource; however, the thresholds can be changed.
To change the thresholds for the Database Files performance counter:
1. From the Database Details view, locate the Database Files resource and
click Edit in the Management field.
523
2. Locate the Database Files performance counter and click [+] to expand the
counter and reveal the counter details.
3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
Database Size by File
This resource lists the current databases sorted by file size. Moving the mouse
over the Database Usage percent value will reveal a tooltip with more detailed
information about that database. Clicking the value will take you to the Custom
Chart resource page. If the Warning or Critical thresholds is breached, the color of
the bar chart will change from green to yellow or red, respectively.
l
l
524
Log Flushes
l
l
Database Files, is used to provide metrics for this resource. This counter is not
listed in the resource; however, the thresholds can be changed.
To change the thresholds for the Database Files performance counter:
1. From the Database Details view, locate the Database Files resource and
click Edit in the Management field.
2. Locate the Database Files performance counter and click [+] to expand the
counter and reveal the counter details.
3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
Log Flushes
This resource contains monitors specific to the current status of log flushes for the
current database. The icons of the listed performance counters in the Statistic
Name column will change color to reflect the listed counter's current state.
525
Counter
Expert Knowledge
Log Bytes
Definition:
Flushed/sec This performance counter shows the average log bytes flushed
per second for the current database since the last data point.
Information:
The value returned helps identify trends of the transaction log. A
log flush happens when data is written from the log cache to the
transaction log on disk, each time a transaction happens.
Note: This is not available in SQL 2012.
Possible problems:
The rate at which log records are written to the disk. This is the
526
Log Flushes
Definition:
This performance counter returns the number of log flushes per
second, averaged since the last collection time.
Information:
A log flush happens when a transaction is committed and data
is written from the log cache to the transaction log file. The log
cache is a location in memory where SQL Server stores data to
be written to the log file. This is used to roll back a transaction
before it is committed. Once complete, the log cache is flushed
to the physical log file on the disk. Generally speaking, log
flushes per second should parallel the number of transactions
per second.
Possible problems:
If the returned value is higher than expected, check your use of
explicit transactions in your queries.
Remediation:
Explicitly define the start and end of your transactions. This
should reduce the number of log flushes, and reduce the impact
on I/O. Also check the Log Bytes Flushed/Sec monitor.
527
Log Flush
Waits/sec
Definition:
This performance counter returns the number of commits, per
second, waiting for the log flush.
Information:
This value should be as low as possible.
Possible problems:
A high number of Log Flush Waits can indicate that it is taking
longer than normal to flush the transaction log cache. This will
slow the performance of your SQL Server.
Remediation:
Check the value of the Disk avg. Write time monitor. If the
returned value is greater than 5ms, then this can indicate that
there is an I/O bottleneck. Move your transaction log file to a
disk drive separate from your data files. This should increase
performance since there is no access competition on the same
disk. Consider upgrading to RAID 10 for transaction log
storage. Also, adding spindles to your RAID array should
increase performance.
Log Flush
Wait Time
Definition:
This performance counter returns the total wait time (in
milliseconds) to flush the log to the transaction log file.
Information:
On an AlwaysOn secondary database, this value indicates the
wait time for log records to be hardened to disk.
528
Storage
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Storage
This resource contains monitors specific to the current storage status of the
current database. The icons of the listed performance counters in the Statistic
Name column will change color to reflect the listed counter's current state.
Clicking any performance counter in the Statistic Name column will take you to
the Performance Counter Details page for that counter.
If the value of a listed performance counter approaches or crosses the Warning
threshold, a yellow band will appear for the listed counter allowing plotted values
that cross the threshold to easily be visualized against the yellow band. If the
value of a listed performance counter approaches or crosses the Critical
threshold, a red band will appear for the listed counter allowing plotted values that
cross the threshold to easily be visualized against the red band. Hovering over
any time period within the chart will display detailed information about that time
period in the tooltip. Hovering over a counter will give you detailed information
about that performance counter.
529
Counter
Expert Knowledge
Backup/
Definition:
Restore
This performance counter shows the Read/Write throughput
Throughput/sec for backup and restore operations of a database per
second.
Information:
You can measure how the performance of the database
backup operation changes when more backup devices are
used in parallel, or when faster devices are used.
Throughput of a database backup or restore operation
allows you to determine the progress and performance of
your backup and restore operations. There are no
thresholds associated with this performance counter.
Log Cache
Reads/sec
Definition:
This performance counter returns the amount of Reads
performed per second through the Log Manager cache.
Total Size
Definition:
This performance counter returns the total size of the
database including white space.
Possible problems:
Running out of storage space.
530
Storage
Remediation:
Shrink the database if free space is running low.
Log File(s) Size
Definition:
This performance counter shows the cumulative size (in
kilobytes) of all the transaction log files in the database.
Information:
Every transaction in the database is logged to the
Transaction log. This is useful during recovery in the event
of data loss. Information about the log file is shown under
theFilessection of the Database Overview page in SQL
Server Management Studio.
The size of this file is based on the logging level set for the
database. By default, a new database uses Full Recovery
Mode or the recovery mode that the model database is set
up as. Transactions in the log file are only removed when a
complete backup or transaction log backup is initiated. This
enables pinpoint recovery for critical applications. Be aware
that if the transaction log is not backed up on a regular
basis, the log will grow until your disk is completely full. The
transaction log should be adjusted to a reasonable size.
This will depend on the number of transactions you expect,
and how often you perform backups.
Set the correct Autogrowth properties: The default of 10%
Autogrowth for data and log files should be enough for low
use databases. Conversely, a 500 MB Autogrowth rate may
be better suited for a busy database, preventing a large I/O
impact caused by normal Autogrowth operations.
Possible problems:
If the returned value occasionally drops to zero, this can
indicate a problem with the following file: sys.master_files.
This file is what the SQL Monitor uses to collect data.
Note: With Simple Recovery Model, fast writing to the
transaction log will trigger Autogrowth.
Remediation:
531
If you do not need pinpoint recovery, it is recommended you switch to Simple Recovery model.
If your database is configured with the Full or Bulk
Logged recovery model, back up the log on a regular
basis so it can be truncated to free up log space.
Definition:
This performance counter shows the cumulative size (in
kilobytes) of all the data files in the database including any
automatic growth.
Information:
Monitoring this counter is useful for determining the correct
size of tempdb. The value returned from this monitor reports
the size of your database (not including the Transaction
log). Information about distinct primary data files and
secondary data files is shown under theFiles section of the
Database Overview page in SQL Server Management
Studio.
Having a file size increase on demand is expensive and
will degrade performance significantly. Autogrowth should
only be used to let a database increase in size if you are
running out of disk space. Autogrowth should not be used
to manage your MDF size increases. Data files should be
sized properly when they are initially created to meet the
expected growth. This also helps avoid fragmentation,
which leads to better database performance.
Possible problems:
Be wary of large and unusual increases to the size of your
data files. Generally speaking, your database should be
sized to minimize Autogrowth. An increase in size is
expensive concerning I/O. Additionally, this will fragment
532
Storage
Shrink Space
Ensure that Full Recovery Mode is used for your databases and that you regularly backup everything,
including the transaction log.
Manually add space as data increases in size. It is
recommended that you have approximately one year
of space available for data growth. If this is not possible, move the database to a higher capacity drive or
simply upgrade the drive.
Note:Compressing files causes fragmentation and is
therefore not recommended.
Definition:
This is essentially the white space in the database that can
be reclaimed by compacting/shrinking the database.
Information:
Shrinking data files recovers space by moving pages of
data from the end of the file to unoccupied space closer to
the front of the file. When enough free space is created at
the end of the file, data pages at end of the file can deallocated and returned to the file system.
Possible problems:
Data that is moved to shrink a file can be scattered to any
available location in the file. This causes index
fragmentation and can slow the performance of queries that
search a range of the index.
Remediation:
To eliminate the fragmentation, consider rebuilding the
indexes on the file after shrinking.
Average
Bytes/Read
Definition:
Perfmon captures the total number of bytes sent to the disk
533
Definition:
Perfmon captures the total number of bytes sent to the disk
(write) and retrieved from the disk (read) over a period of
one second.
Information:
The Disk Read Bytes/sec and the Disk Write Bytes/sec
performance counters break down the results displaying
only read bytes or only write bytes, respectively.
Average Read
Latency
Definition:
This performance counter indicates the response time of
the disk how long it takes for a read request to get
acknowledged by the disk.
Information:
The average read latency should be less than 20ms for
database files.
Average Write
Latency
Definition:
Avg. Disk sec/Write is the average time, in seconds, to write
data to the disk.
Information:
This analysis determines if any of the physical disks are
responding slowly.
Possible problems:
If the response times are greater than .015 (15
milliseconds), then the disk subsystem is keeping up with
demand, but does not have much overhead left.
If the response times are greater than .025 (25
milliseconds), then noticeable slow-downs and
534
Storage
Definition:
This performance counter returns the number of records per
second fetched through forwarded record pointers.
Information:
Heaps have one interesting feature - forwarded records. If a
record needs to be updated and the updated record size is
greater than the current record size, and there is no space
on the page to fit the new record in, then we have two
options:
1. Move the record to a new page and change all the
non-clustered index records that point to it to point to
the new location of the record.
2. Move the record to a new page and leave a forwarding record in the original location to point to the
new location.
Possible problems:
This is one drawback of using heaps - all the extra space
that is wasted with the Forwarding/Forwarded Records.
Another drawback is that when scanning through the heap,
forwarding records have to be followed immediately (as
opposed to ignoring them and just reading the forwarded
records when they are encountered). This is to vastly
reduce the possibility of read anomalies such as nonrepeatable reads or missed rows if a row moves before the
scan point during a scan.
Remediation:
Once a data table (heap) includes forward pointers, there is
only one way to get rid of them : Table Reorg. There are a
few options to do this:
l
535
Definition:
This performance counter displays the number of Reads
performed per second through the Log Manager cache.
Information:
There are no thresholds associated with this performance
counter.
Definition:
This performance counter returns the percentage of Log
cache reads satisfied from the Log cache.
Information:
The log cache is used to hold information that will be
written to the transaction log. There are no thresholds
associated with this performance counter.
Number of
Reads/sec
Definition:
This performance counter returns the number of physical
database page reads issued per second.
Information:
This statistic displays the total number of physical page
reads across all databases. 80 to 90 per second is normal.
Anything that is above 90 indicates indexing or memory
constraint.
Possible problems:
Because physical I/O is expensive, you may be able to
minimize the cost, either by using a larger data cache,
intelligent indexes, and more efficient queries, or by
changing the database design.
Remediation:
Attempt to tune the application so that fewer I/O operations
536
Storage
Definition:
This performance counter returns the number of data pages
written per second.
Information:
Page writes per second are the total number of physical
writes, including checkpoint writes, lazy writer writes, and
large block writes done during index creation or bulk copy
operations.
Possible problems:
If Page Writes/sec is high, this might indicate a SQL Server
performance issue.
Remediation:
If these values are high, you can try to reduce the values by
tuning your application or database to reduce I/O
operations such as index coverage, better indexes,
normalization, increasing the I/O capacity of the hardware,
or by adding memory.
Total Size:
Percent
Change 24 Hrs
Definition:
This value is the same as the value returned by the
performance counter, Total Size but calculated as a
percentage of change over the last 24 hours.
Information:
537
l
l
l
538
To change the thresholds for the Top Indexes for Database performance counter:
The performance counter, Top Indexes for Database, is used to provide metrics
for this resource. This counter is not listed in the resource; however, the
thresholds can be changed.
To change the thresholds for the Top Indexes for Database performance
counter:
1. From the Database Details view, locate the Database Details resource
and click Edit in the Management field.
2. Locate the Top Indexes for Database performance counter and click [+]
to expand the counter and reveal the counter details.
3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
To change the number of tables displayed in this resource, values must be
changed in two locations:
1. In the resource, click Edit.
2. Change the value for the field: Maximum Number of Records to Display,
and then click Submit.
3. Edit the application or the template that the application is based on. To edit
the template which will affect applications based on it:
539
540
Query Text: The text shown is a preview of the full query. To view an entire
query in the list, click [+] next to the query listed to expand and view the
query.
Note: Clicking any listed query will take you to the Most Expensive Queries
resource on the Queries tab, providing greater detail about the query.
541
CPU Time: Display the time, in milliseconds, the listed query took to complete.
Database: Displays the database with which the listed query is associated.
The icon in this column shows the current state of the listed database.
The performance counter, Top Expensive Queries, is used to provide metrics for
this resource and cannot be edited.
Top 10 Nonclustered Indexes by Fragmentation
A non-clustered index is one in which the data rows are not sorted and stored in
order based on their non-clustered keys. This resource displays the non-clustered
indexes with the highest level of fragmentation. If the Warning or Critical
thresholds is breached, the color of the bar chart will change from green to yellow
or red, respectively.
l
l
l
The performance counter, Top Indexes for Database, is used to provide metrics
for this resource. This counter is not listed in the resource; however, the
thresholds can be changed.
To change the thresholds for the Top Indexes for Database performance
counter:
1. From the Database Details view, locate the Database Details resource
and click Edit in the Management field.
542
2. Locate the Top Indexes for Database performance counter and click [+]
to expand the counter and reveal the counter details.
3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
To change the number of tables displayed in this resource, values must be
changed in two locations:
1. In the resource, click Edit.
2. Change the value for the field: Maximum Number of Records to Display,
and then click Submit.
3. Edit the application or the template that the application is based on. To edit
the template which will affect applications based on it:
a. From the web console, navigate to Settings > SAM Settings > Manage Templates.
b. Check the AppInsight for SQL application and click
in the toolbar.
c. Expand the Top Indexes for Database component monitor by clicking [+].
543
544
l
l
l
Name: Displays the name of the listed table of the current database.
Size: Displays the size of the listed table of the current database.
% Used by Index: Displays the percentage of the table space used by the
index.
Total Row Count: Displays the total number of rows in the listed table of
the current database.
The performance counter, Top Tables for Database, is used to provide metrics
for this resource. This counter is not listed in the resource; however, the
thresholds can be changed.
To change the thresholds for the Top Tables for Database performance
counter:
1. From the Database Details view, locate the Database Details resource
and click Edit in the Management field.
2. Locate the Top Tables for Database performance counter and click [+] to
expand the counter and reveal the counter details.
545
3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
l
l
File Path: Displays the full path where the transaction log file resides.
Volume: Displays the volume where the transaction log file resides. Clicking on the volume name will take you to the Volume Details View.
Disk Queue Length: Displays the current disk queue length for the listed
volume as seen on the Volume Details view. Queue lengths that are high for
a sustained period of time are indicative of disk I/O performance issues that
can negatively impact the database.
Total IOPS: Displays the current total read and write IO operations occurring on the drive where the database or transaction log file resides. High I/O
may be normal for some databases, but excessively high I/O will lead to
546
higher queue lengths, meaning there are more requests for disk reads or
writes than the storage subsystem can handle.
Latency: Displays a measurement of disk latency occurring on the disk
where the database or transaction log file resides. High volume latency values indicate sluggish database performance.
The performance counter, Database Files, is used to provide metrics for this
resource. It is used in combination with volume polling. This counter is not listed
in the resource; however, the thresholds can be changed.
To change the thresholds for the Database Files performance counter:
1. From the Database Details view, locate the Database Files resource and
click Edit in the Management field.
2. Locate the Database Files performance counter and click [+] to expand the
counter and reveal the counter details.
3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
Transaction Log Size by File
This resource lists the current status of transaction log files as sorted by size.
Hovering the mouse over a listed percentage will reveal a tooltip with detailed
information about the item listed. Clicking the percentage will take you to the
Database Details page. If the Warning or Critical thresholds is breached, the color
of the bar chart will change from green to yellow or red, respectively.
547
l
l
l
l
File Path: Displays the complete file path of the listed transaction log.
Auto-Growth: Displays the current Auto-growth setting.
File Size: Displays the current size of the listed transaction log.
Database Usage: This resource displays the amount of space consumed
as a percentage of whatever restrictions are in place for the file. For
example:
o If the transaction log is allowed to grow unrestricted, then it is limited
only by the amount of free space on the volume.
o If the transaction log is allowed to grow to a maximum size, the percentage is calculated based on this restricted size limit.
o If the transaction log has a fixed size, the percentage used is calculated based on the total size of the transaction log file and the
amount of remaining white space.
Volume Usage: Displays the amount of space the listed file is consuming
on the volume where it is located.
The performance counter, Database Files, is used to provide metrics for this
resource. This counter is not listed in the resource; however, the thresholds can
be changed.
To change the thresholds for the Database Files performance counter:
1. From the Database Details view, locate the Database Files resource and
click Edit in the Management field.
548
Transactions
2. Locate the Database Files performance counter and click [+] to expand
the counter and reveal the counter details.
3. Click Override Template and adjust the thresholds to suit your needs.
4. When done, click Submit.
Transactions
A transaction is a unit of work that is performed against a database. In other
words, if you are creating a record, for example, then you are performing
transaction on the table. It is important to control transactions to ensure data
integrity and to handle database errors.
This resource contains monitors specific to the current status of transactions. The
icons of the listed performance counters in the Statistic Name column will change
color to reflect the listed counter's current state. Clicking any performance counter
in the Statistic Name column will take you to the Performance Counter Details
page for that counter.
If the value of a listed performance counter approaches or crosses the Warning
threshold, a yellow band will appear for the listed counter allowing plotted values
that cross the threshold to easily be visualized against the yellow band. If the
value of a listed performance counter approaches or crosses the Critical
threshold, a red band will appear for the listed counter allowing plotted values that
cross the threshold to easily be visualized against the red band. Hovering over
any time period within the chart will display detailed information about that time
period in the tooltip. Hovering over a counter will give you detailed information
about that performance counter.
549
Counter
Expert Knowledge
Longest
Transaction
Running
Time
Definition:
This performance counter displays the length of time, in
seconds, the transaction that has been running the longest,
has been active.
Information:
Transactions that run longer than others use more resources.
They can be used to track down procedures and calls that are
taking longer than expected by identifying the specific
transaction(s).
Possible problems:
Long running transactions can prevent truncation of
transaction logs. This can cause the transaction log files to
grow until they consume all available physical disk space
shutting down access to the database.
Remediation:
Check the functionality of the query and/or redesign the long
running transaction.
550
Transactions
Transactions/ Definition:
sec
This performance counter returns the number of transactions
started for the database, per second.
Information:
Transaction rate is affected by general system performance
and resource constraints, such as I/O, number of users, cache
size, and the complexity of requests.
Possible problems:
A high rate of transactions can indicate that some transactions
are not completing.
Remediation:
Using stored procedures in transactions speeds transaction
processing because SQL code in stored procedures runs
locally on the server. The transactions can finish much faster
without the network traffic required by the transactions.
Active
Transactions
Definition:
This performance counter returns the number of active
transactions for the database.
Information:
During an active transaction, no other transaction can modify
the data held by the active transaction. While you are
modifying data, an exclusive lock is held on that data.
Conversely, you cannot read data held by another transaction
because another transaction holds an exclusive lock on the
data that prevents it from being read. The returned value for
this monitor should be less than 200.
Possible problems:
A high number of active transactions can indicate that certain
transactions are never completing.
Remediation:
Keeping a low level of active transactions assists in keeping
requested data accessible.
551
Repl. Trans.
Rate
(Replication
Transactions
Rate)
Definition:
This performance counter returns the number of transactions
read out of the transaction log and sent to the distribution
database
Information:
SQL Server Overall Replication Performance Analysis
provides a graph of several SQL Server overall replication
performance counters for the specified server during the
specified time period. Performance counter data is averaged
by the hour. The graph displays the following replication
performance counters:
l
Bulk Copy
Rows/sec
Definition:
This monitor returns the number of rows bulk copied per
second.
Information:
Measure the number of rows coming into the database.
Optimization yields a higher number. See The Data Loading
Performance Guide http://technet.microsoft.com/enus/library/dd425070(v=SQL.100).aspx
Possible problems:
BCP to bulk load data over the network, having the correct
throughput configured is crucial.
Bulk Copy
Throughput/
Sec
Definition:
This monitor returns the amount of data bulk copied (in
kilobytes) per second.
Possible problems:
Overall throughput will mostly be limited by your I/O
552
subsystem.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
553
554
555
In order to gather information, the user object must be assigned the Mailbox
Search management role within Exchange. In order for the account to be
configured correctly, the account must be a member of the Local Administrators group.
Note: For Exchange access this is not required, but in order to modify
Exchange and WinRM settings on the server, as well as to poll performance
counters, this additional level of permission is required.
PowerShell Requirements
l
l
l
l
l
l
l
l
l
l
556
557
3. Check the Microsoft for Exchange Server box to enable AppInsight Applications data collection. When done, click Submit.
558
5. Click on the newly added AppInsight for Exchange application in this view
and then enter your Exchange credentials when prompted.
559
2. Complete the information on the Define Node step, and then click Next.
3. On the Choose Resources step, check the AppInsight for Exchange
applications you want. AppInsight applications have a unique blue and
white icon, as shown:
560
6. Enter your Exchange credentials when prompted, and then click Configure
Server.
561
The AppInsight for Exchange Details view: This view displays a broad overview of the application.
The Performance Counter Details View: This view displays details about
the selected performance counter.
The Database Details View: This view displays details about the selected
database.
The Mailbox Details View . This view displays details about the selected
mailbox.
From the AppInsight for Exchange Details view, you can select from
the drop down menu and choose to display different amounts of data
562
Editing Resources
Both the titles and subtitles of each resource can be changed by clicking Edit in
the upper right-hand corner of any resource, and then clicking Submit.
Note: As illustrated above, other options may appear depending upon the
resource being edited.
For more information, see:
l
l
l
l
563
564
565
566
WinRM 2.0
PowerShell v2.0
IIS
Enable WinRM
Enable Windows Authentication for PowerShell's web site.
WinRM and Windows Authentication configurations are performed remotely
from SAM.
l
l
567
l
l
The verify you have valid Exchange credentials, run the following cmdlet in the
Exchange Management Shell (EMS):
Get-ManagementRoleAssignment -RoleAssignee USER_IDENTITY
568
l
l
l
l
l
l
569
To correct a Mailbox Search Access configuration error, see Manually Configuring Exchange Server.
570
571
3. After the wizard opens, click Next until you get to the Installation Type page.
4. Select Role-based or feature-based installation.
572
573
574
WinRM 2.0
$cert.Encode()
$enrollment = new-object -com
"X509Enrollment.CX509Enrollment.1"
$enrollment.InitializeFromRequest($cert)
$certdata = $enrollment.CreateRequest(0)
$enrollment.InstallResponse(2, $certdata, 0, "")
575
3. Run the function to create the firewall exception for WSMAN using the
following command:
Add-FirewallRule "Windows Remote Management" "5986" $null
$null
576
Configuring IIS
Configuring IIS
1. Open a command prompt in the Run as Administrator context.
2. Change the directory to C:\Windows\System32\Inetsrv.
3. Type: appcmd.exe unlock config -section:system.webServer/security/authentication/windowsAuthentication
577
and
to verify
578
l
l
579
l
l
l
580
To verify the PowerShell instance used by Exchange on a server, follow the steps
Note: The two items of interest for the URL are Port and URLPrefix. If either of
these have been modified and do not match the default values, edit the
AppInsight for Exchange application with the correct values.
Additionally, the value of Hostname must match the CN of the certificate listed in
the Certificate Thumbprint property.
581
l
l
582
PowerShell Permissions
l
l
l
PowerShell Permissions
To set the appropriate permissions for PowerShell, follow these steps:
1. On the remote computer, open the PowerShell console.
2. Execute Set-PSSessionConfiguration Microsoft.Powershell -ShowSecurityDescriptorUI -Force The permissions dialog should appear.)
3. Uncheck the Deny check box to enable the Full Control option under the
Permissions for Everyone group, then check Allow.
583
5. Click OK.
Note: If PowerShell 2.0 was installed on Windows Server 2012 with Exchange
2013 and subsequently uninstalled, a Microsoft error removes the required
registry key for remote PowerShell to work properly. Security patches or updates
may also cause this issue. You can create the required registry key by following
these instructions:
1. Open Notepad.
2. Copy and paste the following text into Notepad:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_
MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellEngine]
"ApplicationBase"="C:\\Windows\\System32\\WindowsPowerShell
\\v1.0"
584
585
Attachment Extensions
The following table lists the default attachment extensions that are acknowledged
by AppInsight for Exchange:
.accdb
.doc
.inf
.mmp
.ppt
.swf
.xml
.arj
.dot
.ini
.mobi
.ps1
.tar
.xps
.avi
.eml
.iso
.mov
.pst
.tmp
.zip
.bak
.epub
.jar
.mp3
.pub
.txt
.bat
.flv
.jpg
.mpeg
.psd
.vbs
586
.gif
.jpeg
.msg
.rar
.wav
.bmp
.gzip
.lnk
.reg
.wks
.cab
.hta
.log
.png
.rtf
.wma
.cmd
.htm
.mdb
.pot
.sql
.wmv
.csv
.img
.mid
.pps
.svg
.xls
l
l
l
l
To View Alerts:
1. From the web console, navigate to Home >Alerts >Manage Alerts.
2. Select the alerts you want to view from the list, or type a keyword in the text
box and click the Search button:
587
Active Alerts
Application Availability
Application Details
Calendar and Resource Booking
Critical Processes and Services
Exchange Event Log Message Details
Exchange Server
Information Store
Mailbox Database Copies
Mailbox Database Size and Space Used
Mailbox Database Status
Mail Database
Management
Replication
Replication Status Checks
Storage
Users By Mailbox Size
588
Active Alerts
l
l
Note: Chart resources require several values for lines on charts to be visible.
Active Alerts
This resource lists details about all unacknowledged active alerts.
Time of Alert: Displays the time and date the listed alert was triggered.
Object Name: Displays the object that triggered the alert. Clicking the
object will take you to the details page for that object.
Message: Displays the message of the listed alert.
Application Availability
This resource graphically shows the various states of an application in a
percentage format and is made up of three sections: the legend, the main chart,
and the lower chart. The colors of the main chart correspond to the labels in the
legend.
589
Note: This resource will not be available when using Internet Explorer 7.
Consider upgrading Internet Explorer 8 or higher or using FireFox or Chrome as
your web browser.
Zooming
You can have the chart show a predetermined, hourly time period of data by
clicking on any one of the three Zoom buttons; 1h, 12h, or 24h. Alternatively, you
can have the chart show a specific time range by dragging the mouse over a
small area of the chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.
Moving the mouse over the main chart will reveal a tooltip with more detailed
information about the specific time period the mouse is hovering over. By default,
all statistics are shown in the main chart.
590
Application Details
Application Details
This resource provides details concerning the current Exchange application.
l
l
l
l
591
logs.technet.com/b/askpfeplat/archive/2012/06/27/clustering-whatexactly-is-a-file-share-witness-and-when-should-i-use-one.aspx
Witness Share in use: This is the current witness share in use.
Note: This field may be replaced with the Alternate File Share Witness field.
(Alternate File Share Witness): The Alternate FSW is used when the
primary site with the FSW has failed. To use the Alternate FSW
requires manual intervention from the Exchange administrator.
Note: This field may be replaced with the Witness Share in use field.
592
The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter
Expert Knowledge
Warning Critical
Average
Resource
Booking
Processing
Time
Definition:
Shows the average time to process an event in
the Resource Booking Attendant.
> 100
> 100
ms for 5 ms for
polls
15
polls
Information:
Should be a low value at all times.
Possible problems:
High values may indicate a performance
bottleneck.
Remediation:
Check Memory andCPU status for any
bottlenecks.Review event logs for related
events examining log entries for each Assistants
Infrastructure and its corresponding assistant.
Use the Exchange Troubleshooting Assistant
(ExTRA) to obtain Event Tracing for Windows
traces.
Resource
Booking
Definition:
>0
Shows the total number of failures that occurred
593
> 0 for
15
Requests
Failed
polls
Information:
Should be 0 at all times.
Possible problems:
Meeting Room bookings or updates may not be
processed for some users.
Remediation:
Review event logs for related events examining
log entries for each Assistants Infrastructure and
its corresponding assistant. Use the Exchange
Troubleshooting Assistant (ExTRA) to obtain
Event Tracing for Windows traces. Verify your
resource mailboxes are properly configured.
Average
Calendar
Attendant
Processing
Time
Definition:
Shows the average time to process an event in
the Calendar Attendant.
Information:
Should be a low value at all times.
> 100
> 100
ms for 5 ms for
polls
15
polls
Possible problems:
High values may indicate a performance
bottleneck.
Remediation:
Check Memory andCPU for any bottlenecks.
Review event logs for related events examining
log entries for each Assistants Infrastructure and
its corresponding assistant. Use the Exchange
Troubleshooting Assistant (ExTRA) to obtain
Event Tracing for Windows traces.
Calendar
Attendant
Requests
Failed
Definition:
>0
Shows the total number of failures that occurred
while the Calendar Attendant was processing
events.
Information:
594
> 0 for
15
polls
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l
595
Microsoft
Exchange
Information
Store
596
Microsoft
Exchange
Mailbox
Assistant
Microsoft
Exchange
Monitoring
Microsoft
Exchange
Replication
Microsoft
Exchange
RPC Client
Access
Microsoft
Exchange
Search
Indexer
Microsoft
Enables Windows Server Backup users to back up and recover
Exchange
application data for Microsoft Exchange. This service has no
Server
dependencies.
Extension for
Windows
Server
597
Backup
Microsoft
Provides a host for several Microsoft Exchange services. On
Exchange
internal server roles, this service is dependent upon the
Service Host Microsoft ExchangeActive Directory Topology service.
Microsoft
Exchange
System
Attendant
Microsoft
Exchange
Throttling
Microsoft
Exchange
Transport
Log Search
Microsoft
Search
(Exchange)
Microsoft
Exchange
598
Anti-spam
Update
Microsoft
Exchange
Mailbox
Transport
Delivery
Microsoft
Exchange
Diagnostics
Microsoft
Exchange
EdgeSync
Exchange
Search
Microsoft
Exchange
Health
Manager
Microsoft
Exchange
IMAP4
Backend
Microsoft
Exchange
Information
Store
599
Microsoft
Exchange
Mailbox
Assistant
Microsoft
Exchange
Mailbox
Replication
Microsoft
Exchange
Monitoring
Microsoft
Exchange
POP3
Backend
Microsoft
Exchange
Replication
Microsoft
Exchange
RPC Client
Access
600
Microsoft
Exchange
Server
Extension for
Windows
Server
Backup
Microsoft
Exchange
Search Host
Controller
Microsoft
Exchange
Service Host
Microsoft
Exchange
Mailbox
Transport
Submission
Microsoft
Exchange
Throttling
Microsoft
Exchange
Transport
Microsoft
Exchange
Transport
Log Search
601
Microsoft
Exchange
Unified
Messaging
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, and Last Page.
Clicking any event message in the list will open a new window, displaying the
entire message, as shown below:
602
Exchange Server
Exchange Server
This resource contains performance counters specific to the current status of the
Exchange Server. The icons of the listed performance counters in the Statistic
Name column will change color to reflect the listed counter's current state.
Clicking any performance counter in the Statistic Name column will take you to
the Performance Counter Details page for that counter.
If the value of a listed performance counters crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
counter crosses the Critical threshold, the chart will display a red background.
Hovering over any time period within the chart will display detailed information
about that time period in the tooltip.
603
The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter
Expert Knowledge
Warning Critical
RPC
Requests
failed (%)
Definition:
>1
Shows the percentage of failed requests in the
total number of RPC requests. Failed means
the sum of failed with error code plus failed
with exception.
> 1 for
15
polls
Information:
Should be less than 1 at all times
Possible problems:
Users may report slow performance,
disconnects, or failures within their client
performing certain activities.
Remediation:
Review the Windows Event logs for any
related events. Use ExBPA to perform a Health
scan of your server and review any issues
reported.In Exchange 2010, verify SP1 or
higher has been installed on your system.
RPC
Definition:
>0
604
> 0 for
Exchange Server
Requests
Shows thecurrent number of outstanding RPC
Outstanding requests.
15
polls
Information:
Should be 0 at all times.
Possible problems:
Server may stop accepting RPC requests.
Remediation:
Review the Windows Event logs for any
related events. Use ExBPA to perform a Health
scan of your server and review any issues
reported. Use Exchange Server User Monitor
application to review user sessions.In
Exchange 2010, verify SP1 or higher has been
installed on your system.
RPC
Latency
Average
(msec)
Definition:
Shows the average latency, in ms, of RPC
requests. The average is calculated over all
RPCs since exrpc32 was loaded.
> 100
ms
> 100
ms for
15
polls
N/A
N/A
Information:
The average is calculated over all RPCs since
exrpc32 was loaded. Should be less than 100
ms at all times.
Possible problems:
Users may report slow performance issues.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.
RPC
Requests
sent/sec
Definition:
RPC Requests sent/sec is the current rate of
initiated RPC requests per second.
Information:
Used for determining current load.
605
RPC Slow
requests
latency
average
(msec)
Definition:
Shows the average latency, in ms, of slow
requests.
N/A
N/A
>1
>1 for
15
polls
N/A
N/A
Information:
Used for determining the average latencies of
RPC slow requests.
Possible problems:
Client disconnects or slow performance issues.
Remediation:
Review the Windows Event logs for any
related events. Use ExBPA to perform a Health
scan of your server and review any issues
reported.In Exchange 2010, verify SP1 or
higher has been installed on your system.
RPC Slow
Definition:
requests (%) RPC Slow requests (%) is the percent of slow
RPC requests among all RPC requests.
Information:
A slow RPC request is one that has taken
more than 500 ms.Should be less than 1 at all
times.
Possible problems:
Client disconnects or slow performance issues.
Remediation:
Review the Windows Event logs for any
related events. Use ExBPA to perform a Health
scan of your server and review any issues
reported.In Exchange 2010, verify SP 1 or
higher has been installed on your system.
ROP
Definition:
Requests
ROP Requests outstanding shows the total
Outstanding number of outstanding remote operations
requests.
Information:
606
Exchange Server
Used for determining current load.
Hub Servers Definition:
> 0.99
In Retry
Shows the number of Hub Transport servers in
retry mode.
(Only
available in
Exchange
2010)
>1
Information:
Should be 0 at all times.
Possible problems:
Domain where you send large amount of email
is unavailable, infected machine on network
sending messages, DNS resolution issues, or
network connectivity to destination servers or
the internet.
Remediation:
Determine the root cause and verify there
aren't any network connectivity issues.
Average
Document
Processing
Time In
Milliseconds
Definition:
> 30
Shows the average, in ms, of how long it takes
to index documents.
> 30 for
15
polls
Information:
Should be less than 30 seconds at all times.
Possible problems:
Verify content index state of all database
copies.
Remediation:
For any database indexes not "healthy,"
update the content Index on the server using
the following command: UpdateMailboxDatabaseCopy <DBName> -CatalogOnly
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
607
Information Store
This resource contains performance counters specific to the status of the current
Information Store. The icons of the listed performance counters in the Statistic
Name column will change color to reflect the listed counter's current state.
Clicking any performance counter in the Statistic Name column will take you to
the Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
The Exchange Information Store is a storage platform that is used to manage
numerous types of information within an Exchange server deployment.
The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter
Expert Knowledge
Warning Critical
608
Information Store
Connection Definition:
Count
Is the total number of client connections
maintained.
(Only
available in
Exchange
2013)
N/A
N/A
N/A
N/A
> 100
ms
> 100
ms for
15
Information:
This is used to determine current load of the
server's Information Store.
Possible problems:
May cause memory bottlenecks on the server if
the number is excessively high.
Remediation:
Reduce the number of user mailboxes hosted
on the server or increase available resources.
Definition:
Indicates the RPC latency, in ms, averaged for
all operations in the last 1,024 packets.
609
Information:
For information about how clients are affected
when overall server RPC averaged latencies
increase, see Understanding Client Throttling
Policies at http://technet.microsoft.com/enus/library/dd297964.aspx. Should not be higher
than 100 ms on average.
polls
Possible problems:
To determine if certain protocols are causing
overall RPC latencies, monitor MSExchangeIS
Client (*)\RPC Average Latency to separate
latencies based on client protocol.
Remediation:
Faster disks, more disks, or redesigning
existing disk arrays.
RPC
Requests
Definition:
Indicates the overall RPC requests currently
executing within the information store process.
> 70
> 70 for
15
polls
N/A
N/A
Information:
Should be below 70 at all times.
Possible problems:
When I/O counters fall outside of normal range,
client performance is directly impacted. For
example, Outlook and Outlook Web App (OWA)
users will report Outlook is slow when
opening mail or moving between folders.
Remediation:
Faster disks, more disks, or redesigning
existing disk arrays.
Active
Definition:
Connection Number of connections that have shown some
Count
activity in the last 10 minutes.
(Only
available in
Information:
This is used to determine current load of the
610
Information Store
Exchange
2010)
Client:
RPCs
Failed:
Server too
busy/sec
(Only
available in
Exchange
2010)
Definition:
Shows the client-reported rate of failed RPCs
(since the store was started) due to the Server
Too Busy ROC error.
Information:
Should be 0 at all times.
Possible problems:
Higher values may indicate RPC threads are
exhausted or client throttling is occurring for
clients running versions of Outlook earlier than
Microsoft Office Outlook 2007. This can cause
user mail clients experiencing slowness.
Remediation:
Check if RPC latencies are high and determine
the cause of the performance issue (e.g. poorly
performing disk I/O, excessive load, insufficient
memory, high number of users).
Information:
Indicates the rate at which client backoffs are
occurring.
Possible problems:
Higher values may indicate that the server may
be incurring a higher load resulting in an
increase in overall averaged RPC latencies,
611
N/A
N/A
Definition:
N/A
Number of logons that have been active (issued
any MAPI requests) within the last10 minute
time interval.
N/A
Information:
Active client logons can be high if users are
logging on and logging off frequently.
Possible problems:
May cause memory bottlenecks on the server if
the number is excessively high.
Remediation:
Determine if users are running applications not
required for business use, and request they do
not run these applications which is causing an
increase in server logons. If this does not help,
or is not possible, reduce the number of server
hosted on the server and move any Public
Folders on the server to a different server.
Messages Definition:
Queued for Shows the current number of submitted
Submission messages not yet processed by the transport
layer.
(Only
available in
Exchange
Information:
The queues should remain below 50 at any
612
>50
> 50 for
15
polls
Information Store
2010)
Slow
FindRow
Rate
Definition:
Shows the rate at which the slower FindRow
needs to be used in the mailbox store.
(Only
available in
Exchange
2010)
Information:
Should be no more than 10 for any specific
mailbox store.
Possible problems:
Higher values indicate applications are
crawling or searching mailboxes, which is
affecting server performance. These include
desktop search engines, customer relationship
management (CRM), or other third-party
applications.
Remediation:
Run the ResetSearchIndex.ps1 script which is
located in the scripts directory at the root of the
Exchange installation. Alternatively, you can
perform the process manually:
1. Rebuild the index catalog using: UpdateMailboxDatabaseCopy <DBName> -CatalogOnly
command.
2. Stop the Microsoft Exchange Search Service.
3. Delete old catalog files.
4. Restart Microsoft Exchange Search Service.
Zooming
613
N/A
N/A
Table 1.
Mounted
614
The active copy is coming online and not yet accepting client
connections. Only the active copy of the mailbox database copy
can have a copy status of Mounting.
Dismounting
Dismounted
Seeding
Seeding
Source
Initializing
ReThe mailbox database copy and its log files are being compared
synchronizing with the active copy of the database to check for any divergence
between the two copies. The copy status will remain in this state
until any divergence is detected and resolved.
Single Page
Restore
Failed
615
Suspended
Healthy
616
Description
Status
on
Active &
Passive
Copies
Crawling
Disabled
Offline
(Active)
N/A
(Passive)
Failed
Critical
Failed and The Failed and Suspended states have been set
Suspended simultaneously by the system because a failure was
detected, and because resolution of the failure explicitly
requires administrator intervention.
Critical
Healthy
Seeding
Suspended The Suspended status occurs if an administrator manually pauses or suspends it from receiving updates from
the active copy. This might be done to update a failed
Content Index or to perform troubleshooting for other
issues.
Warning
617
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, Last Page, Number
of Items to Display on the Current Page, as shown:
l
l
618
l
l
Mounting
619
Dismounted
Seeding
Seeding
Source
Initializing
ReThe mailbox database copy and its log files are being
synchronizing compared with the active copy of the database to check for
any divergence between the two copies. The copy status
will remain in this state until any divergence is detected and
resolved.
Single Page
Restore
Failed
620
Suspended
Healthy
621
Copy Queue Length: The copy queue length is an integer indicating number of files. The Copy Queue Length shows the number of transaction log
files waiting to be copied to the passive copy log file folder. A copy is not
considered complete until it has been checked for corruption.
Replay Queue Length: The Replay Queue Length shows the number of
transaction log files waiting to be replayed into the passive copy.
Last Inspected Log Time: This is the date and time when the last log file
was verified (inspected) by the LogInspector for a particular database after
being copied from the active copy. This field is only relevant for passive copies of a database.
Content Index State: See the following table for returned status descriptions.
State
Description
Status
on
Active &
Passive
Copies
Crawling
Warning
Disabled
Offline
(Active)
N/A
(Passive)
Failed
Failed and The Failed and Suspended states have been set
Critical
Suspended simultaneously by the system because a failure
was detected, and because resolution of the failure
explicitly requires administrator intervention.
622
Mail Database
Healthy
Seeding
Up
Mail Database
This resource contains performance counters specific to the status of the current
Mail Database. The icons of the listed performance counters in the Statistic Name
column will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
623
The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter
Expert Knowledge
Warning Critical
Database Definition:
N/A
Cache
Shows the amount of system memory, used by the
Size (MB) database cache manager to hold commonly used
information from the database files to prevent file
operations.
Information:
This and Database Cache Hit % are useful
counters for gauging whether a server's
performance problems might be resolved by
adding more physical memory. Use this counter
along with store private bytes to determine if there
are store memory leaks.
Possible problems:
Situation when the database cache size seems
too small for optimal performance and there is little
available memory on the system (check the value
of Memory/Available Bytes) could negatively
impact on performance. If there is ample memory
624
N/A
Mail Database
on the system and the database cache size is not
growing beyond a certain point, the database
cache size may be capped at an artificially low
limit. Increasing this limit may increase
performance.
Remediation:
Adding more memory to the system and/or
increasing database cache size may increase
performance.
Database
Page
Fault
Stalls/sec
Definition:
> 0
Shows the rate that database file page requests
require of the database cache manager to allocate
a new page from the database cache.
> 0 for
15
polls
Information:
Should be 0 at all times.
Possible problems:
If this value is nonzero, this indicates that the
database is not able to flush dirty pages to the
database file fast enough to make pages free for
new page allocations.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.
Version Definition:
Buckets Shows the total number of version buckets
Allocated allocated.
Information:
Should be less than 12,000 at all times. The
maximum default version is 16,384. If version
buckets reach 70% of maximum, the server is at
risk of running out of the version store.
Possible problems:
625
Information:
The average value should be below 10 per
second. Spikes (maximum values) should not be
higher than 100 per second.
Possible problems:
If I/O log write latencies are high, check for RAID5
or synchronize replication on log devices.
Remediation:
You can also use the MSExchange Database
Instances (Information store/<Database Name>)
\log record stalls/sec counter to determine which
database(s) may be having issues. This will assist
you in determining which drive(s) to focus on. This
counter is an extended Exchange counter in
Performance Monitor. The solution can include
additional disks, reconfigured RAID configuration,
adding new database(s), or re-balancing
mailboxes across databases or servers.
Log
Threads
Waiting
Definition:
> 10 for > 10 for
Shows the number of threads waiting for their data 15 polls 60
to be written to the log to complete an update of
polls
626
Management
the database. If this number is too high, the log
may be a bottleneck.
Information:
Should be less than 10 on average.
Possible problems:
If this number is too high, the log may be a
bottleneck. Regular spikes concurrent with log
record stall spikes indicate that the transaction log
disks are a bottleneck. If the value for log threads
waiting is more than the spindles available for the
logs, there is a bottleneck on the log disks.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l
Management
This resource contains controls that are actionable for both the application and
the node. The controls in the following illustration are SAM-specific.
627
Application:
l
Edit Application Monitor: This allows you to edit the current application by
changing the settings specifically related to this application. This includes,
but is not limited to: changing the polling frequency, changing the Windows
and PowerShell URLs, changing the Exchange Server credentials, and
adjusting threshold settings for component monitors that have thresholds.
Changing some settings may require you to override the template that this
application is based upon. To do this, simply click Override Template.
628
Replication
Unmanage: Allows you to stop the polling and collecting of statistics of the
current application for a user-defined period of time.
Poll Now: Allows the application to retrieve the most current statistics when
clicked.
Note: By default, mailbox statistics are not polled when Poll Now is clicked.
Node:
l
Replication
This resource contains performance counters specific to the status of the current
replication process. The icons of the listed performance counters in the Statistic
Name column will change color to reflect the listed counter's current state.
Clicking any performance counter in the Statistic Name column will take you to
the Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
629
The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter
Expert Knowledge
Warning Critical
CopyQueueLength
Definition:
Shows the number of transaction log
files waiting to be copied to the
passive copy log file folder. A copy
isn't considered complete until it has
been checked for corruption.
>1
Information:
Allnodes in a Database Availability
Group (DAG) should be monitored for
this counter depending on the passive
node. Should be less than 1 at all
630
> 1 for
5 polls
Replication
times for continuous replication.
Possible problems:
Server recently rebooted or services
restarted, network connectivity issues,
or multiple mailbox moves are in
process.
Remediation:
Verify network connectivity between
the various nodesin the DAG. Verify
Replication Service is running on all
DAG members.
ReplayQueueLength Definition:
Shows the number of transaction log
files waiting to be replayed into the
passive copy.
> 50 for
5 polls
> 100
for 5
polls
N/A
N/A
Information:
With DAG replication, transaction logs
are shipped to the other DAG
members. They then replay the log
file. (Thresholds should be manually
removed for DAG members
configured to be 'lagged copies.')
Possible problems:
The replay queue length should be as
low as possible, otherwise this could
indicate a (performance) issue with
the DAG member containing the Copy
database. A high number could also
negatively affect failover with some
loss of data as a possibility.
Remediation:
Check Memory, CPU, and Disk I/O for
any bottlenecks. Review the Windows
Event logs for any related events.
Avg Log Copy
Definition:
631
Latency (msec)
(Only available in
Exchange 2010)
Log Copy KB/sec
N/A
N/A
Definition:
N/A
The number of log files that have been
replayed per second.
N/A
Information:
Shows the size in KB/secof the
transaction logs being copied to
passive copies.
Log Replay Rate
(generations/sec)
Information:
Shows you the number of Transaction
Logs being replayed on the passive
copies of a database.
Log Replay is Not
Keeping Up
Definition:
LogReplayNotKeepingUp is 1 when
log replay is falling behind and not
able to keep up with log copying and
inspection.
Information:
Exchange 2010/2013 uses
continuous replication to create and
maintain database copies. To
maintain a synchronized copy of a
mailbox database, transaction log files
from the active mailbox server are
replayed into the passive database of
another server in the DAG. This
provides high availability and
resiliency in the Exchange
environment.
632
>= 1
>= 1
for 60
polls
633
The table below provides a list of all possible tests for this resource along with
their definitions.
Health Check Test
Name
Description
TcpListener
TasksRpcListener
ServerLocatorService
634
QuorumGroup
FileShareQuorum
DBInitializing
DBDisconnected
DBCopySuspended
DBCopyFailed
635
DatabaseRedundancy
(Only 2013)
DatabaseAvailability
(Only 2013)
DagMembersUp
ClusterService
ClusterNetwork
ActiveManager
Storage
This resource contains performance counters specific to the status of storage. The
icons of the listed performance counters in the Statistic Name column will change
color to reflect the listed counter's current state. Clicking any performance counter
in the Statistic Name column will take you to the Performance Counter Details
page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
636
Storage
The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter
Expert Knowledge
Warning Critical
I/O Database
Reads
Average
Latency
Definition:
Shows the average length of time, in ms, per
database read operation.
>50 ms >50
msfor
15
polls
Information:
Should be 20 ms on average.Spikes should
not exceed 50 ms.
Possible problems:
Users may report sluggish responsiveness
within their email client.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.
637
> 100
ms
> 100
ms for
Average
Latency
15
polls
Information:
Should be 50 ms on average. Spikes of up to
100 ms are acceptable if not accompanied by
database page fault stalls.
Possible problems:
Users may report sluggish responsiveness
within their email client.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.
I/O Log
Reads
Average
Latency
Definition:
Indicates the average time, in ms, to read data
from a log file. Specific to log replay and
database recovery operations.
> 200
ms
> 200
ms
for15
polls
Information:
Average should be less than 200 ms with
spikes up to 1000 ms
Possible problems:
Users may report sluggish responsiveness
within their email client.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.
I/O Log
Writes
Average
Latency
Definition:
> 10 ms > 10
Indicates the average time, in ms, to write a log
ms for
buffer to the active log file.
15
polls
Information:
This count should be 10 ms or less on
production servers.
638
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l
If there are no user mailboxes on a given database, this resources will disappear from the Mailbox Database Details page.
If there are no user mailboxes in any of the active databases on an
Exchange server, this resource will disappear from the Application Details
page.
639
User mailbox information is collected only once a day after midnight, local
time.
640
If there are no user mailboxes or mailbox quotas are not in use on a given
database, this resources will disappear from the Mailbox Database Details
page.
If there are no user mailboxes or mailbox quotas are not in use in any of the
active databases on an Exchange server, this resource will disappear from
the Application Details page.
User mailbox information is collected only once a day after midnight, local
time.
641
642
If there are no user mailboxes on a given database, this resources will disappear from the Mailbox Database Details page.
If there are no user mailboxes in any of the active databases on an
Exchange server, this resource will disappear from the Application Details
page.
User mailbox information is collected only once a day after midnight, local
time.
If Server Mailbox Accounts Statistics is disabled, this resource, as well as
the Messages Sent and Messages Received charts on the Mailbox Details
view, will disappear.
643
644
Notes:
l
645
Note: This resource will not be available when using Internet Explorer 7.
Consider upgrading Internet Explorer 8 or higher or using FireFox or Chrome as
your web browser.
Zooming
You can have the chart show a predetermined, hourly time period of data by
clicking on any one of the three Zoom buttons; 1h, 12h, or 24h. Alternatively, you
can have the chart show a specific time range by dragging the mouse over a
small area of the chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.
646
Database Copies
Moving the mouse over the main chart will reveal a tooltip with more detailed
information about the specific time period the mouse is hovering over. By default,
all statistics are shown in the main chart.
Database Copies
This resource provides details concerning the status of the current Exchange
server being monitored by the application.
l
l
Mounting
Dismounting
Dismounted
Seeding
Seeding
Source
647
Initializing
ReThe mailbox database copy and its log files are being
synchronizing compared with the active copy of the database to check for
any divergence between the two copies. The copy status
will remain in this state until any divergence is detected and
resolved.
Single Page
Restore
Failed
Service
Down
Suspended
Healthy
648
Database Copies
Disconnected The mailbox database copy is no longer connected to the
and Healthy active database copy, and it was in the Healthy state when
the loss of connection occurred. This state represents the
database copy with respect to connectivity to its source
database copy. It may be reported during DAG network
failures between the source copy and the target database
copy.
Disconnected The mailbox database copy is no longer connected to the
and Reactive database copy, and it was in the Re-synchronizing
synchronizing state when the loss of connection occurred. This state
represents the database copy with respect to connectivity to
its source database copy. It may be reported during DAG
network failures between the source copy and the target
database copy.
Failed and
Suspended
649
State
Description
Status
on
Active &
Passive
Copies
Crawling
Warning
Disabled
Offline
(Active)
N/A
(Passive)
Failed
Failed and The Failed and Suspended states have been set
Critical
Suspended simultaneously by the system because a failure
was detected, and because resolution of the failure
explicitly requires administrator intervention.
Healthy
Seeding
Up
650
Database Details
Database Details
This resource provides details concerning the current database.
l
l
651
Table 1.
This table shows how the value for the Summary Status field is calculated. If the
conditions in the first four columns are met, the status in the Final SAMStatus
column is displayed in the Summary Status field.
DB Copy
DB Copy Status (Passive) DB Content DB Content Final
Status (Active)
Index State Index State SAM
Statu
(Active)
(Passive)
s
Dismounted
Any
Any
Any
Offline
Dismounting
Any
Any
Any
Warni
ng
Failed
Any
Any
Any
Down
Initializing
Any
Any
Any
Warni
ng
Mounted,
DisconnectedAndHealthy
Seeding, or
SeedingSource
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
Mounted,
DisconnectedAndHealthy
Seeding, or
SeedingSource
Any other
Critica
l
652
Any
Database Details
Mounted,
DisconnectedAndResynchr Healthy,
Any
Seeding, or
onizing
Seeding, or
SeedingSou
SeedingSource
rce
Warni
ng
Mounted,
DisconnectedAndResynchr Any other
Seeding, or
onizing
SeedingSource
Any
Critica
l
Mounted,
Failed
Seeding, or
SeedingSource
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
Mounted,
Failed
Seeding, or
SeedingSource
Any other
Any
Critica
l
Mounted,
FailedAndSuspended
Seeding, or
SeedingSource
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
Mounted,
FailedAndSuspended
Seeding, or
SeedingSource
Any other
Any
Critica
l
Mounted,
Healthy
Seeding, or
SeedingSource
Healthy,
Seeding, or
SeedingSou
rce
Healthy,
Up
Seeding, or
SeedingSou
rce
Mounted,
Healthy
Seeding, or
SeedingSource
Healthy,
Any other
Seeding, or
SeedingSou
rce
Warni
ng
Mounted,
Healthy
Seeding, or
SeedingSource
Crawling
Any
Warni
ng
Mounted,
Any other
Healthy,
Warni
Healthy
653
Seeding, or
SeedingSource
Seeding, or ng
SeedingSou
rce
Mounted,
Healthy
Seeding, or
SeedingSource
Any other
Mounted,
Initializing
Seeding, or
SeedingSource
Healthy,
Any
Seeding, or
SeedingSou
rce
Up
Mounted,
Initializing
Seeding, or
SeedingSource
Any other
Any
Warni
ng
Mounted,
Resynchronizing
Seeding, or
SeedingSource
Healthy,
Seeding, or
SeedingSou
rce
Healthy,
Up
Seeding, or
SeedingSou
rce
Mounted,
Resynchronizing
Seeding, or
SeedingSource
Healthy,
Any other
Seeding, or
SeedingSou
rce
Mounted,
Resynchronizing
Seeding, or
SeedingSource
Any other
Healthy,
Warni
Seeding, or ng
SeedingSou
rce
Mounted,
Resynchronizing
Seeding, or
SeedingSource
Any other
Any other
Mounted,
Seeding
Seeding, or
SeedingSource
Healthy,
Any
Seeding, or
SeedingSou
rce
Up
Mounted,
Any other
Warni
Seeding
654
Any other
Any
Critica
l
Warni
ng
Critica
l
Database Details
Seeding, or
SeedingSource
ng
Mounted,
SeedingSource
Seeding, or
SeedingSource
Healthy,
Any
Seeding, or
SeedingSou
rce
Up
Mounted,
SeedingSource
Seeding, or
SeedingSource
Any other
Any
Warni
ng
Mounted,
Service Down
Seeding, or
SeedingSource
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
Mounted,
Service Down
Seeding, or
SeedingSource
Any other
Any
Critica
l
Mounted,
SinglePageRestore
Seeding, or
SeedingSource
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
Mounted,
SinglePageRestore
Seeding, or
SeedingSource
Any other
Any
Critica
l
Mounted,
Suspended
Seeding, or
SeedingSource
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
Mounted,
Suspended
Seeding, or
SeedingSource
Any other
Any
Critica
l
Mounting
Any
Any
Warni
ng
Any
655
Service Down
Any
Any
Any
Down
SinglePageRe DisconnectedAndHealthy
store
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
SinglePageRe DisconnectedAndHealthy
store
Any other
Any
Critica
l
Warni
ng
Any
Critica
l
SinglePageRe Failed
store
Any
Any
Critica
l
SinglePageRe FailedAndSuspended
store
Any
Any
Critica
l
SinglePageRe Healthy
store
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
SinglePageRe Healthy
store
Crawling
Any
Critica
l
SinglePageRe Healthy
store
Any other
Any
Critica
l
SinglePageRe Initializing
store
Any
Any
Critica
l
SinglePageRe Resynchronizing
store
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
SinglePageRe Resynchronizing
Any other
Critica
656
Any
Database Details
store
SinglePageRe Seeding
store
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
SinglePageRe Seeding
store
Any other
Any
Critica
l
SinglePageRe SeedingSource
store
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
SinglePageRe SeedingSource
store
Any other
Any
Critica
l
Any
Any
Critica
l
SinglePageRe SinglePageRestore
store
Any
Any
Critica
l
SinglePageRe Suspended
store
Healthy,
Any
Seeding, or
SeedingSou
rce
Warni
ng
SinglePageRe Suspended
store
Any other
Critica
l
Any
Table 2.
Mounted
Mounting
The active copy is coming online and not yet accepting client
connections. Only the active copy of the mailbox database copy
can have a copy status of Mounting.
Dismounting
657
Seeding
Seeding
Source
Initializing
ReThe mailbox database copy and its log files are being compared
synchronizing with the active copy of the database to check for any divergence
between the two copies. The copy status will remain in this state
until any divergence is detected and resolved.
Single Page
Restore
Failed
658
Suspended
Healthy
659
l
l
l
l
l
l
660
Database I/O
Database I/O
This resource contains performance counters specific to the status of database
I/O. The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter
Expert Knowledge
Warning Critical
I/O
Definition:
Database Shows the average length of time, in ms, per
Reads
database read operation.
Average
661
> 50 ms >50
msfor
5 polls
Latency
Information:
Should be 20 ms on average.Spikes should not
exceed 50 ms.
Possible problems:
Users may experience decreased performance,
including delayed message deliveries.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration. Review the event logs for related
events. Verify network topology between mailbox
servers and storage resources. Examine CPU &
Memory usage to determine possible bottlenecks.
Examine replication status forreplica database.
I/O
Database
Writes
Average
Latency
Definition:
Shows the average length of time, in ms, per
database write operation.
>100
ms
> 100
ms for
5 polls
> 200
> 200
Information:
Should be 50 ms on average. Spikes of up to 100
ms are acceptable if not accompanied by
database page fault stalls.
Possible problems:
Users may experience decreased performance,
including delayed message deliveries.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.Review the event logs for related
events. Verify network topology between mailbox
servers & storage resources. Examine CPU and
Memory usage to determine possible bottlenecks.
Examine replication status forreplica database.
I/O Log
Definition:
662
Database I/O
Reads
Indicates the average time, in ms, to read data
ms
Average from a log file. Specific to log replay and database
Latency recovery operations.
ms
for5
polls
Information:
Average should be less than 200 ms with spikes
up to 1,000 ms
Possible problems:
Users may experience decreased performance,
including delayed message deliveries.
Remediation: If the disk subsystem is not meeting
demand, correcting the problem may require
additional disks, faster disks, or modifying the disk
configuration.Review the event logs for related
events. Verify network topology between mailbox
servers & storage resources. Examine CPU and
Memory usage to determine possible bottlenecks.
Examine replication status forreplica database.
I/O Log
Writes
Average
Latency
Definition:
Indicates the average time, in ms, to write a log
buffer to the active log file.
Information:
This count should be 10 ms or less on production
servers.
Possible problems:
Indication that the Exchange Database\I/O
Database Writes Average Latency is too high
Remediation: If the disk subsystem is not meeting
demand, correcting the problem may require
additional disks, faster disks, or modifying the disk
configuration.Review the event logs for related
events. Verify network topology between mailbox
servers & storage resources. Examine CPU and
Memory usage to determine possible bottlenecks.
Examine replication status forreplica database.
663
> 10 ms > 10
ms for
5 polls
Log
Threads
Waiting
Definition:
> 10 for
Shows the number of threads waiting for their data 5 polls
to be written to the log to complete an update of
the database. If this number is too high, the log
may be in a bottleneck situation.
> 10
for15
polls
Information:
Should be less than 10 on average.
Possible problems:
If this number is too high, the log may be a
bottleneck. Regular spikes concurrent with log
record stall spikes indicate that the transaction log
disks are in a bottleneck situation. If the value for
log threads waiting is more than the spindles
available for the logs, there is a bottleneck on the
log disks.
Remediation:
If the disk subsystem is not meeting demand,
correcting the problem may require additional
disks, faster disks, or modifying the disk
configuration.Review the event logs for related
events. Verify network topology between mailbox
servers and storage resources. Examine CPU and
Memory usage to determine possible bottlenecks.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
l
664
Database Metrics
Database Metrics
This resource contains performance counters specific to the status of database
metrics. The icons of the listed performance counters in the Statistic Name
column will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter
Expert Knowledge
Warning Critical
Active Client
Logons
Definition:
The number of clients that performed
any action within the last 10 minute
interval.
N/A
(Only available in
Exchange 2010)
Information:
665
N/A
Definition:
Shows the rate at which the slower
FindRow needs to be used in the
mailbox store.
Information:
Should be no more than 10 for any
specific mailbox store.
Possible problems:
Higher values indicate applications are
crawling or searching mailboxes, which
is affecting server performance. These
include desktop search engines,
customer relationship management
(CRM), or other third-party applications.
Remediation:
Run the ResetSearchIndex.ps1 script
which is located in the scripts directory
at the root of the Exchange installation.
Alternatively, you can perform the
666
>10
> 10 for
15
polls
Database Metrics
process manually:
1. Rebuild index catalog using UpdateMailboxDatabaseCopy <DBName> -
command.
2. Stop the Microsoft Exchange Search
Service.
3. Delete old catalog files.
4. Restart the Microsoft Exchange
Search Service.
CatalogOnly
Average
Document
Indexing Time
(At the database
level, this is only
available in
Exchange 2010. At
the application
level, this is
available for both
Exchange 2010
and 2013.)
Mailboxes
processed/sec
(Only available in
Exchange 2013)
> 30for
15
polls
command.
N/A
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Notes:
667
Events
This resource contains performance counters specific to the status of database
events. The icons of the listed performance counters in the Statistic Name column
will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
Counter
Expert Knowledge
Warning Critical
Average
Definition:
Event
Shows the average processing time of the
Processing events chosen.
668
>2
> 2 for
15
polls
Events
Time In
Seconds
Information:
Should be less than 2 at all times.
Possible problems:
Indicates the Mail Submission Assistant is not
able to handle the number of submission
requests being made to the database. May
occurwhen serveris experiencing a heavy load
which can cause messages to queue on the
server.
Remediation:
Review event logs for related events examining
log entries for each Assistant's infrastructure
and its corresponding assistant.
Events in
Queue
Definition:
Shows the number of events in the in-memory
queue waiting to be processed by the
assistants.
> 20
> 50
Events
Definition:
N/A
Polled/sec Shows the number of events polled per second.
N/A
Information:
Should be a low value at all times.
Possible problems:
High values may indicate a performance
bottleneck.
Remediation:
Review event logs for related events. Monitor
CPU and memory for bottlenecks.
Information:
Determines current load statistics for this
counter.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
669
Messages
This resource contains performance counters specific to the status of messages.
The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that counter.
If the value of a listed counter crosses the Warning threshold, the chart for the
listed monitor will display a yellow background. If the value of a listed
performance counter crosses the Critical threshold, the chart will display a red
background. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
The following table lists the default performance counters for this resource along
with their respective definitions and troubleshooting information, including default
Warning and Critical thresholds:
670
Messages
Counter
Expert Knowledge
Warning Critical
Messages
Queued For
Submission
Definition:
Shows the current number of submitted
messages not yet processed by the transport
layer.
> 30
> 50
N/A
N/A
N/A
N/A
(Only
available in
Exchange
2010)
Information:
The queues should remain below 50 at any
given time. Anything above this amount
should be cleared within 15 minutes.
Possible problems:
Mailbox server is not communicating properly
with the transport server.
Remediation:
Verify network connectivity and transport
server functionality. Additional bottlenecks
may include disk reads or writes, processor
time, available memory, and network
configuration.
Messages
Sent/sec
(Only
available in
Exchange
2010)
Definition:
Shows the rate that messages are sent to
transport.
Information:
Used to determine current messages sent to
transport.
Messages
Definition:
Delivered/sec Shows the rate that messages are delivered
to all recipients.
(Only
available in
Exchange
2010)
Information:
Indicates current message delivery rate to the
store.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
671
l
l
l
672
l
l
l
l
Mailbox Details
Mailbox Synced Devices
Received Mail
Sent Mail
Total Mailbox and Attachments Sizes
Note: Chart resources require several values for lines on charts to be visible.
Mailbox Details
This resource provides details about the current user's mailbox.
673
l
l
674
l
l
Last Logged On: The time and date the listed user logged in to the mailbox.
Mailbox Last Modified: The time and date the listed mailbox was last modified.
Alias: The legible name for the listed user's email address.
Mailbox Limits:
l Issue Warning: Displays the size limit of the mailbox before it issues
a usage warning.
l Prohibit Send: Displays the size limit of the mailbox when it is no
longer able to send emails.
l Prohibit Send and Receive: Displays the size limit of the mailbox
when it is no longer able to send or receive emails.
Device Type: Lists the device the mailbox is being synced with.
Device User Agent: Displays the operating system and build of the listed
device.
Last Successful Sync: Displays the last time the listed device was successfully synced with the current mailbox.
Received Mail
This resource graphically details the value history of the current performance
counter, in this case, the total amount of received mail for the selected mailbox.
Hovering over any time period within the chart will display detailed information
about that time period in the tooltip.
The colors of the main chart correspond to the labels in the legend. You can
choose which data to display by using the check boxes in the legend.
675
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart or manipulating the sliders of the lower chart.
Sent Mail
This resource graphically details the value history of the current performance
counter, in this case, the number of messages sent for the selected mailbox.
Hovering over any time period within the chart will display detailed information
about that time period in the tooltip.
676
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart or manipulating the sliders of the lower chart.
Total Mailbox and Attachments Sizes
This resource graphically details the value history of the current performance
counter, in this case, the total size of the selected mailbox and its attachments.
677
Note: Attachment Size shows the total size of those email messages that
include attachments, including the email message body.
For more information, see Mailbox Details.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart or manipulating the sliders of the lower chart.
678
Important: The following log file contains all the information and errors related to
the WinRM configuration process:
C:\ProgramData\Solarwinds\Logs\APM\RunWinRMConfigurator.log
Troubleshooting Permissions
The following information will help you troubleshoot issues with the following:
l
l
l
l
Non-Domain Accounts
Adding Local Administrative privileges to Active Directory Account
Exchange Access
Mailbox Exchange Access
Note: Mailboxes with an empty primary SMTP address can be polled; however,
their Sent and Received statistics will not be not available.
Non-Domain Account
Local accounts (Non-Domain) cannot access Exchange Management interfaces
and therefore are not supported by AppInsight for Exchange. Please select an
Active Directory account or create a new one to use with AppInsight for
Exchange.
Add Local Administrative privileges to Active Directory Account
1. On the server where you want to grant local administrative privileges, open
a Computer Management console.
2. Navigate to System Tools >Local Users and Groups > Groups and then
double click the Administrators group.
3. Click Add and type in the Active Directory username of the account you
want to grant administrative privileges to, and then press Enter. (Ensure the
location is set to either the domain where the account is located or Entire
Directory.)
4. Click Apply and then click OK.
5. Alternatively, you can add an Active Directory group to the Local Administrators group and then add the AD user accounts to that group.
679
Exchange Access
680
Troubleshooting Permissions
Granting Least Privilege access to the Exchange Organization can be
accomplished using Active Directory Users and Computers (ADUC)
1. From the Start Menu open ADUC and navigate to the Microsoft Exchange
Security Groups OU.
2. Double click on the View-Only Organization Management group.
3. After the window opens, click the Members tab and then click Add.
4. Type the username of the account you want to grant access to the
Exchange organization, and then click OK.
5. Click Apply and then click OK .
6. Close the ADUC window.
Access can also be granted using the Exchange Management
Shell with the following command:
Note: Replace the word "user" with the correct user name of the
service account.
Add-RoleGroupMember -Identity "View-Only Organization
Management" -Member "USER"
or
Get-ManagementRoleAssignment -RoleAssignee USER |
Where-Object {$_.RoleAssigneeName -eq "View-Only
Organization Management" -or $_.RoleAssigneeName -eq
"Organization Management"}
681
http://technet.microsoft.com/en-us/library/dd876958(v=exchg.150).aspx
http://www.powershellmagazine.com/2013/05/23/pstip-retrieve-group-membership-of-an-active-directory-group-recursively/
Example: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ESE\Performance]
"Close"="ClosePerformanceData"
"Collect"="CollectPerformanceData"
682
"Open"="OpenPerformanceData"
"PerfIniFile"="<Name of performance counter INI file>"
Example: "PerfIniFile"="eseperf.ini"
The "Library" file path is typically "C:\Program
Files\Microsoft\Exchange
Server\%ExchangeVersion%\Bin\perf\%Processor_
Architecture%\%DLLFileName%"
Figure 1.
3. Verify the counters have not been disabled by expand the service and then
clicking on the "Performance" key.
4. Check for the value Disable Performance Counters (See Figure 2.) If this
value exists, ensure the data value is 0. Any other value will disable the
counters.
5. Once the value is confirmed to be set to 0, close all PerfMon windows and
then reopen them.
Note: The performance counters should be visible at this time. If the performance counters are not visible, proceed to the next step.
Figure 2.
683
6. If the values First Counter, First Help, Last Counter, and Last Help are listed (See Figure 3), it is highly recommended to unload the performance
counters prior to reloading them.
Figure 3.
684
5. Check the application log to verify the counters were properly loaded and
no PerfLib errors exist. Reopen PerfMon to ensure the counters are available.
Figure 4.
Configuration Errors
Error Message, Information, and Remediation
Error message: Remote configuration was unsuccessful due to the following:
"The deployment service executable was not found on the Orion server." For
details, see the log on the Orion server: ([ALLUSERSPROFILE]
685
\ProgramData\Solarwinds\Logs\APM\RemoteExecutableStarter.log).
Description: Internal error. The Remote Installation Service.exe file was not
found. (Default file location: C:\Program Files (x86)\SolarWinds\Orion\APM).
This can be caused by an incorrect SAM installation or Remote Installation
Service.exe was deleted or modified.
Remediation: Add the Remote Installation Service.exe file to the following
folder: C:\Program Files (x86)\SolarWinds\Orion\APM.
Remediation:
686
687
2. Specify which user(s) can access the Administrator Shares (Disk Volumes).
3. Enable File and print sharing through the
Windows firewall.
4. Check to see if you can access the Administrator share from another computer.
5. When complete, rerun the AppInsight for
Exchange Automatic Configuration Wizard.
688
SolarWinds.APM.RemoteWinRmConfiguratorFull.exe
689
Remediation:
l
l
690
691
Remediation:Add SolarWinds.APM.RemoteWinRmConfiguratorFull.exe.config
to the following location: C:\Program Files (x86)\SolarWinds\Orion\APM.
692
693
694
695
privileges." Learn how to correct this. For details, see the log on the remote
computer. ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\RunWinRMConfigurator.log).
Description: The provided user account does not have Local Administrative
privileges.
Remediation:
Add Local Administrative privileges to Active Directory Account:
1. On the server where you wish to grant local administrative privileges, open
a Computer Management console.
Note: On Windows 2012, add this privilege using the Active Directory console.
2. Navigate to System Tools >Local Users and Groups > Groups and
double click the Administrators group.
3. Click Add and type in the Active Directory username of the account you
want to grant administrative privileges, and then press Enter. (Ensure the
location is set to either the domain where the account is located or Entire
Directory.)
4. Click Apply and then click OK.
Note: Alternatively, you can add an Active Directory group to the local
administrators group and add the Active Directory user accounts to that
group.
Error message: Remote configuration was unsuccessful due to the following:
"This account must be an Active Directory account with organization wide
Exchange access (View-Only-Organization Management and Mailbox Search
Management Role)." Learn how to correct this. For details, see the log on the
remote computer. ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\RunWinRMConfigurator.log).
Description: The provided user account does not have View-Only-Organization
Management or Mailbox Search Management privileges.
Remediation:
Grant View-Only-Organization Management privileges:
Granting Least Privilege access to the Exchange Organization can be
accomplished using Active Directory Users and Computers (ADUC). To
accomplish this, take the following steps:
696
697
698
699
700
701
The following reports are installed for use with AppInsight for IIS:
l
l
l
l
For more information, see Predefined Server & Application Monitor Web Console
Based Reports
l
l
IISVersion Supported
Microsoft Windows
2008
IIS 7.0
Microsoft Windows
2008 R2
IIS 7.5
702
IIS 8.0
Microsoft Windows
2012 R2
IIS 8.5
Notes:
l
l
703
Site Details View: This view displays an overview of a particular site being
monitored.
Application Pool Details View: This view displays details about the selected
application pool.
From the AppInsight for IISDetails view, you can select from the drop down menu
and choose to display different amounts of data based on a time range, as shown:
704
Editing Resources
Editing Resources
Both the titles and subtitles of each resource can be changed by clicking Edit in
the upper right-hand corner of any resource, and then clicking Submit.
The time and date displayed at the top of each resource (where applicable)
shows the range of data currently loaded into the resource. This, along with the
Sample Interval Range, can be changed by clicking Edit from within the resource.
Additionally, certain resources will allow you to add and remove component
monitors from the resource. You can do this by clicking the Edit button, and then
checking the component monitors you want to keep.
Note: Pertinent data for each resource is grouped together by default.
705
State
Alert Description
Alert Trigger
Trigger Action
is
currently ${N=SwisEntity;M=DisplayState}.
Attempting to restart Application Pool
${N=SwisEntity;M=Name} now. For more information
click the URL below.
706
<br/>
<br/>
${N=SwisEntity;M=DetailsUrl}
Trigger Reset
Action
Email Notification:
Subject: Application Pool ${N=SwisEntity;M=Name}
on ${N=SwisEntity;M=Application.Node.Caption} is
${N=SwisEntity;M=DisplayState}
Message Body: The IIS Application Pool
${N=SwisEntity;M=Name} on
is
now ${N=SwisEntity;M=DisplayState}. For more
information click the URL below.
${N=SwisEntity;M=Application.Node.Caption}
<br/>
<br/>
${N=SwisEntity;M=DetailsUrl}
2. Alert Name
State
Alert Description
This alert will attempt to restart any site that is monitored by AppInsight for IIS that is found to be in a
Stopped state.
Alert Trigger
Trigger Action
707
is
is
currently ${N=SwisEntity;M=DisplayState}.
Attempting to restart Site ${N=SwisEntity;M=Name}
now. For more information click the URL below.
<br/>
<br/>
${N=SwisEntity;M=DetailsUrl}
Trigger Reset
Action
Email Notification:
Subject: IIS Site ${N=SwisEntity;M=Name} on
${N=SwisEntity;M=Application.Node.Caption}
${N=SwisEntity;M=DisplayState}.
is
<br/>
<br/>
${N=SwisEntity;M=DetailsUrl}.
3. Alert Name
State
Alert Description
Alert Trigger
Trigger Action
Email Notification:
708
URL: ${N=SwisEntity;M=URLStem}
Average Server Execution Time:
${N=SwisEntity;M=AverageElapsedTime}
ms
Viewing Alerts:
1. From the web console, navigate to Home >Alerts.
2. Select the alerts you want to view by checking its box and clicking View
Alert Details.
709
l
l
Creating Alerts
Predefined Server & Application Monitor Web Console Based Reports
To add AppInsight for IIS, see Adding AppInsight for IIS to a Node
710
5. Click on the newly added AppInsight for IIS application in this view and then
enter your IIS credentials when prompted.
711
2. Fill out the information on the Define Node step, and then click Next.
712
6. Click on the newly added AppInsight for IIS application in this view and then
enter your IIS credentials when prompted.
713
714
715
716
717
718
719
720
IP address: Mandatory
Certificate lifetime in days: Optional
You can run this script with the default arguments from the PowerShell console or
specify each one.
For example:
& '.\Create self-signed certificate script.ps1' 192.168.2.69 3650
l
l
Without parameters: The rule will be created with the default name, "Windows Remote Management HTTP/SSL" for port 5986.
With one parameter: Non-default custom port.
With two parameters: Non-default custom port and rule name
You can run this script with the default arguments from the PowerShell console or
specify each one.
For example:
& '.\Add firewall rule.ps1' 5988 "My custom firewall rule name"
721
l
l
is 150
You can run this script with the default arguments from the PowerShell console or
specify each one.
For example:
& '.\Update WsMan Limits.ps1'
722
Additionally, the value of Hostname must match the CN of the certificate listed in
the Certificate Thumbprint property.
723
Active Alerts
Application Availability
Application Details
Application Pools
Cache
Connections
IIS Average CPU and Memory Usage
IIS Average Network Traffic
Event Log Message Details
724
Active Alerts
l
l
l
l
Management
Processes and Services
Sites
Top Page Requests by Average Server Execution Time
Note: Chart resources may not display data until multiple successful polls have
completed.
Active Alerts
This resource lists details about all unacknowledged active alerts.
Application Availability
This resource graphically shows the various states of an application's availability
in a percentage format and is made up of three sections: the legend, the main
chart, and the lower chart. The colors of the main chart correspond to the labels in
the legend.
725
Note: This resource will not be available when using Internet Explorer 7.
Consider upgrading Internet Explorer 8 or higher or using FireFox or Chrome as
your web browser.
Zooming
You can have the chart show a predetermined, hourly time period of data by
clicking on any one of the three Zoom buttons; 1h, 12h, or 24h. Alternatively, you
can have the chart show a specific time range by dragging the mouse over a
small area of the chart.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders. The main view of the chart will
display the selected time period between the two sliders of the lower chart.
Moving the mouse over the main chart will reveal a tooltip with more detailed
information about the specific time period the mouse is hovering over. By default,
all statistics are shown in the main chart.
726
Application Details
Application Details
This resource provides details concerning the current application. You can click
on both the application and the node to be taken to their respective details page.
Component Name: Displays the component name along with its current status as indicated by the icon.
Component Type: Displays the information about the current component.
Component Status: Displays the current status of the listed component.
Application Pools
This resource shows the status of all monitored application pools for the current
IISapplication. The data can be sorted by clicking the headers of each column.
727
Name: Displays the name of the listed application pool, in addition to the
current performance status as indicated by the icon. Clicking the name of
the application pool will take you to the Application Pool Details page.
State: Displays the current state of the listed application pool. Possible
states include: Stopped, Started, Stopping, and Starting.
Worker Processes: Displays the current number of worker processes the
listed application pool is using.
CPU: Displays the percentage of CPUcurrently being used for the listed
application pool.
Physical Memory: Displays the amount of physical RAM the listed application pool is currently using.
Virtual Memory: Displays the amount of virtual RAM the listed application
pool is currently using.
Note: You can search for an application pool by entering text in the Search field
and clicking
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, Last Page, Items on
Page, as shown:
728
Cache
Cache
This resource contains monitors specific to the current status of the IISapplication
cache. The icons of the listed performance counters in the Statistic Name column
will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that performance counter.
If the value of a listed performance counter approaches or crosses the Warning
threshold, a yellow band will appear for the listed counter allowing plotted values
that cross the threshold to easily be visualized against the yellow band. If the
value of a listed performance counter approaches or crosses the Critical
threshold, a red band will appear for the listed counter allowing plotted values that
cross the threshold to easily be visualized against the red band. Hovering over
any time period within the chart will display detailed information about that time
period in the tooltip. Hovering over a counter will give you detailed information
about that performance counter.
Counter
Expert Knowledge
Definition:
This performance counter returns
729
Warning Critical
Definition:
This performance counter returns
the current memory usage by
output cache.
Definition:
This performance counter returns
the ratio of user-mode file cache
hits to the total number of cache
requests since the service started.
Information:
This counter reflects how well the
settings for the IIS file cache are
working. A site with mostly static
files should have a very high
cache hit percentage (70%85%).
If the Kernel: Cache Hits %
counter is low, this value should
be high. Note that this counter
does not include dynamic content,
only static files. If your static files
are not being cached, you might
want to lengthen the activity period
for this cache.
Possible problems:
The value returned from Kernel:
Cache Hits % is low.
Remediation:
If the value returned from Kernel:
Cache Hits % is low, examine
your file set and determine why
your files are not being cached.
Definition:
This performance counter returns
730
< 90
< 70
Cache
the ratio of kernel URI cache hits
to the total number of cache
requests since the service started.
Metadata Cache
Hits %
Definition:
This performance counter returns
the ratio of user-mode metadata
cache hits to total number of cache
request since the service started.
Definition:
This performance counter returns
the output cache current hit ratio.
The ratio is calculated as (H)/
(H+M), where H and M represent
Hits and Misses in previous
sample intervals, respectively.
Definition:
This performance counter returns
the ratio of user-mode URI Cache
Hits to the total number of cache
requests since the service started.
Information:
If content cannot be cached in the
HTTP.sys response cache, the
value of this counter should be as
high as possible. If your content
can be stored in the HTTP.sys
response cache, the value of this
counter should be low.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
731
732
Connections
Counter
Expert Knowledge
Total
Connection
Attempts
Description:
This displays the total number of connections to the Web or
FTP service that have been attempted since service startup.
The count is the total for all web sites or FTP sites combined,
regardless of the instance selected.
Information:
This number does not include connection attempts that failed
at the TCP (transport) or IP (network) layer.
Total Logon
Attempts
Definition:
This displays the total number of successful logons to the Web
or FTP service since the service started.
Information:
This number does not include failed logon attempts.
Current
Description:
Connections This displays the current number of connections established
with the Web service.
Information:
This is the sum of both non-anonymous (authenticated) and
anonymous (unauthenticated) users.
Possible problems:
If this number is at or near the maximum connections allowed,
the Web service is near or at full capacity.
Remediation:
If the value is too high for a particular IIS server, then load
balancing or clustering technologies can be applied to lower
the burden of the server in question. Also check the Web Site
property page for maximum connection limit.
Current
Anonymous
Users
Description:
This displays the number of Current Anonymous Users who
currently have an anonymous connection using the Web
service.
733
Information:
If anonymous connections are not permitted on the server, the
value of all anonymous user counters is always zero.
Current
NonAnonymous
Users
Description:
This displays the number of Current Non-Anonymous Users
who currently have a non-anonymous connection using the
Web service.
Information:
If authentication is not enabled on the server, and none of the
applications that run on the server request or require
authentication, then the value of all non-anonymous user
counters is always zero.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
IIS Average CPU and Memory Usage
This resource graphically and numerically details the consumption of IIS as it
relates to the overall resource utilization of the server itself. This allows you to
determine if performance issues are caused by IIS, or if IIS performance is
impacted by other applications, processes, or services running on the server.
This resource has three tabs, allowing you to see the charts for CPUusage,
Physical Memory Usage, and Virtual Memory Usage. Hovering over any time
period within the chart will display detailed information about that time period in
the tooltip. The colors of the main chart correspond to the labels in the legend.
You can choose which data to display by using the check boxes in the legend, as
well as cycling through the three different tabs.
734
735
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons. Alternatively, you can have the chart show a
specific date range by dragging the mouse over an area of the chart or
manipulating the sliders of the lower chart.
IIS Average Network Traffic
This resource graphically details the history of IIS network traffic. Hovering over
any time period within the chart will display detailed information about that time
period in the tooltip. The colors of the main chart correspond to the labels in the
legend. You can choose which data to display by using the check boxes in the
legend.
736
Traffic Source: Lists the sources of network traffic that is displayed in the
chart. Non-IIS Processes and Services are those resources consumed by
other applications running on the server that are not associated with IIS.
Latest Network Traffic: Displays the network traffic rate for the listed
source in kilobytes per second.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
737
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, and Last Page.
Clicking any event message in the list will open a new window, displaying the
entire message, as shown below:
738
Management
Application:
l
Edit Application Monitor: This allows you to edit the current application by
changing the settings specifically related to this application. This includes,
but is not limited to: changing the polling frequency, changing the Windows
and PowerShell URLs, changing the IIS Server credentials, and adjusting
threshold settings for component monitors that have thresholds.
Note: Changing some settings may require you to override the template that
this application is based upon. To do this, click Override Template.
Unmanage: Allows you to stop the polling and collecting of statistics of the
current application for a user-defined period of time.
739
Poll Now: Allows the application to retrieve the most current statistics when
clicked.
Note: By default, statistics are not polled when Poll Now is clicked.
Node:
l
l
l
l
740
Sites
Sites
This resource shows the status of all monitored sites of the current IISapplication.
Name: Displays the name of the listed site in addition to the current performance status as indicated by the icon. Clicking the name of the site will
take you to the Site Details page.
State: Displays the current state of the listed site. Possible states include:
Stopped, Started, Stopping, and Starting.
Connections: Displays the current number of connections for the listed
sites.
Response Time (Avg): Displays the average response time of the listed
site in milliseconds.
Start Mode: Displays how the listed site begins running. The ServerAutoStart property indicates if the server instance should start automatically
when the server is powered on. This property is reset automatically when a
server instance is stopped or restarted to maintain the state across service
restarts.
Note: You can search for a site by entering text in the Search field and clicking
.
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
741
This resource is specific to the IIS site. Another instance of this resource is
available at the application level for all sites.
IISlogging must be enabled. The W3C or IIS log format should be configured on the IIS server.
742
l
l
Site: Displays the site name with which the URL is associated. Clicking the
arrow to the left of the site name will bring up detailed information about the
listed web request (URL), including the following:
l Verb: Displays the web request action performed. Example verbs
shown in this column are GET, POST, PUT, DELETE, HEAD,
DELETE, OPTIONS, and CONNECT.
l Request Date: Displays the date and time of the client web request.
l Elapsed Time: Displays the amount of server time that was needed to
fulfill the listed request.
l Client IP: Displays the IPaddress of the client computer for the listed
request.
l URLQuery: Displays the query parameters associated with client's
web request. If no query parameters were specified in the request, this
field will be blank.
URL: Displays the URL stem of the listed request.
Average Server Execution Time: Displays the average time of all page
requests of the same type based on the URL stem.
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, Last Page, Number
of Items to Display on the Current Page, as shown:
743
Bindings
Connections
Files
Log Size by File
Management
Network I/O
Requests
Site Availability
Site Details
Site Size by Directory
SSL Certificate Expiration
Top Page Requests by Average Server Execution Time
Web Server Response Time
Note: Chart resources may not display data until multiple successful polls have
completed.
Bindings
This resource monitors binding information for the current site.
Type: This resource will identify and report the following types:
l Http
l Https
l Net.TCP
l Net.Pipe
744
Connections
Net.MSMQ
l MSMQ.FormatName
Binding Information: The asterisk (*) is the server's IP address that the site
is bound to and refers to all of the IP addresses on the server. This is directly followed by the port number (eg: *.80:). The hexadecimal number is the
IPv6 address.
Browse...: Clicking Browse... on the selected binding will take you to the
HTTP or HTTPS binding and port for the current site that is being monitored
by AppInsight for IIS.
l
Connections
This resource contains monitors specific to the current status of the active
connections for the current IISwebsite. The icons of the listed performance
counters in the Statistic Name column will change color to reflect the listed
counter's current state. Clicking any performance counter in the Statistic Name
column will take you to the Performance Counter Details page for that counter.
If the value of a listed performance counter approaches or crosses the Warning
threshold, a yellow band will appear for the listed counter allowing plotted values
that cross the threshold to easily be visualized against the yellow band. If the
value of a listed performance counter approaches or crosses the Critical
threshold, a red band will appear for the listed counter allowing plotted values that
cross the threshold to easily be visualized against the red band. Hovering over
any time period within the chart will display detailed information about that time
period in the tooltip. Hovering over a counter will give you detailed information
about that performance counter.
745
Counter
Expert Knowledge
Total
Description:
Connections This displays the total number of connections to the Web or
Attempts
FTP service that have been attempted since service startup.
The count is the total for all Web sites or FTP sites combined,
regardless of what you choose for the instance.
Information:
This number does not include connection attempts that failed
at the TCP (transport) or IP (network) layer.
Total Logon
Attempts
Description:
This displays the total number of successful logons to the Web
or FTP service since the service started.
Information:
This does not include failed logon attempts.
Current
Description:
Connections This displays the current number of connections established
746
Connections
Description:
This displays the number of users who currently have an
anonymous connection using the Web service.
Information:
If anonymous connections are not permitted on the server, the
value of all anonymous user counters is always zero.
Current
NonAnonymous
Users
Description:
This displays the number of users who currently have a nonanonymous connection using the Web service.
Information:
If authentication is not enabled on the server, and none of the
applications that run on the server request or require
authentication, then the value of all nonanonymous user
counters is always zero.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
747
Counter
Expert Knowledge
Critical
Files
Received
Description:
The displays the number of files that have been
received by the WWW service since the service
748
Files
started.
Files Sent
Description:
The displays the number of files that have been
sent by the WWW service since the service started.
Information:
This value does not include cache hits. Note that
this counter does not increment when files are
being served from the kernel-mode cache.
Description:
The displays the number of requests that have been
made since the service started and could not be
satisfied by the server because the requested
document was locked.
Information:
This is usually reported as HTTP error 423.
Note: A baseline is required.
Not Found
Errors
Description:
The displays the number of requests that have been
made since the service started and were not
satisfied by the server because the requested
document was not found.
Information:
This is usually reported as HTTP error 404.
Zooming
749
>0
Sustained
Status:
3 out of 5
polls
Folder Path: Displays the path to the directory where log files are stored.
The path displayed is linked to the Custom Chart page and can be
accessed by clicking the displayed path.
Number of Files: Displays the total number of log files in the listed directory.
Total File Size: Displays, in bytes, the amount of disk space being used to
store the total number of log files in the listed directory.
Volume Usage: Numerically and graphically displays the percentage of
volume space used by the listed log files.
Management
This resource contains controls that are actionable for the current site. The
controls in the following illustration are SAM-specific.
750
Network I/O
l
l
l
Restart: This stops the site from running and then restarts it.
Start/Stop: Allows you to start or stop the site.
Unmanage Web Site: Allows you to stop the polling and collecting of statistics of the current web site.
Network I/O
This resource contains monitors specific to byte traffic across the current website.
The icons of the listed performance counters in the Statistic Name column will
change color to reflect the listed counter's current state. Clicking any performance
counter in the Statistic Name column will take you to the Performance Counter
Details page for that performance counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that performance counter.
Counter
Expert Knowledge
Total Bytes
Received
Description:
This displays the total number of bytes received by the Web
service since the service started.
Information:
This information can be used to determine network load on a
751
Description:
This displays the total number of bytes sent by the Web
service since the service started.
Information:
This information can be used to determine network load on a
specific Web site.
Total Bytes
Transferred
Description:
This displays the total number of bytes sent and received by
the Web service since the service started.
Information:
This information can be used to determine network load on a
specific Web site.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Requests
This resource contains monitors specific to the current status of the IISsite
requests. The icons of the listed performance counters in the Statistic Name
column will change color to reflect the listed counter's current state. Clicking any
performance counter in the Statistic Name column will take you to the
Performance Counter Details page for that performance counter.
If the value of a listed performance counter crosses the Warning threshold, the
chart for the listed counter will display a yellow background. If the value of a listed
monitor crosses the Critical threshold, the chart for the listed counter will display a
red background. Hovering over any time period within the chart will display
752
Requests
detailed information about that time period in the tooltip. Hovering over a counter
will give you detailed information about that performance counter.
Counter
Expert Knowledge
Total
Method
Requests
Description:
This displays the number of HTTP requests that have been made
since the WWW service started.
Delete
Requests
Description:
This displays the number of HTTP requests that have used the
DELETE method since the WWW service started.
Get
Requests
Description:
This displays the number of HTTP requests that have used the
GET method since the WWW service started.
753
Information:
GET requests are generally used for basic file retrievals or image
maps, though they can be used with forms.
Head
Requests
Description:
This displays the number of HTTP requests that have used the
HEAD method since the WWW service started.
Information:
HEAD requests typically indicate that a client is querying the state
of a document they already have to see if it needs to be refreshed.
CGI
Requests
Description:
This displays the number of all CGI requests that have been made
since the WWW service started.
Information:
CGI requests are custom gateway executable (.exe) files the
administrator can install to add forms processing or other dynamic
data sources. CGI requests spawn a process on the server which
can be a large drain on server resources.
ISAPI
Description:
Extension This displays the number extension of ISAPI requests that have
Requests been made since the WWW service started.
Information:
ISAPI Extension Requests are custom gateway DLLs which the
administrator can install to add forms processing or other dynamic
data sources.
Put
Requests
Description:
This displays the number of HTTP requests using the PUT
method since the WWW service started.
Post
Requests
Description:
This displays the number of HTTP requests that have used the
POST method since the WWW service started.
Information:
Post requests are generally used for forms or gateway requests.
754
Site Availability
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Site Availability
This resource graphically shows the various states of a website's availability in a
percentage format and is made up of three sections: the legend, the main chart,
and the lower chart. The colors of the main chart correspond to the labels in the
legend.
755
l
l
756
Folder Path: Displays the folder path for the current site.
Number of Files: Displays the total number of files located in the folder
path for the current site.
Total File Size: Displays the total size, in MB, for all of the files located in
the folder path for the current site.
Volume Usage: Numerically and graphically displays the total percentage
of volume space consumed by the current site.
757
758
l
l
This resource is specific to the IIS site. Another instance of this resource is
available at the application level for all sites.
IISlogging must be enabled. The W3C or IIS log format should be configured on the IIS server.
Site: Displays the site name with which the URL is associated. Clicking the
arrow to the left of the site name will bring up detailed information about the
listed web request (URL), including the following:
l Verb: Displays the web request action performed. Example verbs
shown in this column are GET, POST, PUT, DELETE, HEAD,
DELETE, OPTIONS, and CONNECT.
l Request Date: Displays the date and time of the client web request.
l Elapsed Time: Displays the amount of server time that was needed to
fulfill the listed request.
l Client IP: Displays the IPaddress of the client computer for the listed
request.
l URLQuery: Displays the query parameters associated with client's
web request. If no query parameters were specified in the request, this
field will be blank.
URL: Displays the URL stem of the listed request.
Average Server Execution Time: Displays the average time of all page
requests of the same type based on the URL stem.
759
Counter
Expert Knowledge
HTTPMonitor
Definition:
This performance counter returns
the amount of time the listed web
server spends accepting incoming
sessions and transmitting the
requested page, in milliseconds,
760
Definition:
This performance counter returns
the amount of time the listed web
server spends accepting incoming
sessions and transmitting the
requested page, in milliseconds,
for the HTTPS protocol.
Note: The HTTPS monitor will not appear if the site is not configured for HTTPS.
Similarly, if the Orion server is unable access an HTTP site via its configured
URL, this resource will not appear because these components will automatically
be disabled. You can re-enable and configure these monitors via the application
editor.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
761
Note: This resource will not be available when using Internet Explorer 7.
Consider upgrading Internet Explorer 8 or higher or using FireFox or Chrome as
your web browser.
Zooming
You can have the chart show a predetermined, hourly time period of data by
clicking on any one of the three Zoom buttons; 1h, 12h, or 24h. Alternatively, you
762
l
l
Application Pool Name: Displays the name of the listed application pool.
Application Pool State: Displays the current state of the listed application
pool. Possible states include Started, Stopped, and Unknown.
Worker Process Status: Displays the current status of the listed worker processes. Possible statuses include Up, Down, Not Running, Warning, Critical, and Unknown.
Start Automatically: Displays how the listed application pool is started.
Possible values include Yes and No.
Start Mode: Displays the current configuration mode. The Application Pool
can be set to run in On Demand Mode or Always Running Mode.
. Net Framework Version: Displays the version of Microsoft's .Net framework currently utilized by the application pool.
763
Management
This resource contains controls that are actionable for the application pool. The
controls in the following illustration are SAM-specific.
Recycle: Allows the worker process that handles requests for that application pool to be terminated and a new one started.
Start/Stop: Allows you to start and stop the worker processes of the application pool.
Unmanage Application Pool: Allows you to stop the polling and collecting
of statistics of the current application pool.
764
Counter
Expert Knowledge
Warning
Current
Worker
Processes
Description:
This displays the current number of worker
processes that are running in the application pool.
Recent
Worker
Process
Failures
Description:
This displays the number of times that the worker
process for the application pool failed during the
rapid-fail protection interval.
> 0 (CaD
enabled)
Information:
This counter should be counted as difference with
a threshold greater than 0.
Total
Application
Pool
Description:
This displays the number of times that the
application pool has been recycled since Windows
765
> 0 (CaD
enabled)
Recycles
Total Worker
Process Failures
Description:
This displays the number of times that worker
processes have crashed since the application pool
was started.
> 0 (CaD
enabled)
Information:
This counter should be counted as difference with
a threshold greater than 0.
Total Worker
Process Ping
Failures
Description:
This displays the number of times that Windows
Process Activation Service (WAS) did not receive
a response to ping messages sent to a worker
process.
> 0 (CaD
enabled)
Information:
This counter should be counted as difference with
a threshold greater than 0.
Total Worker
Process Shutdown Failures
Description:
This displays the number of times that Windows
Process Activation Service (WAS) failed to shut
down a worker process.
> 0 (CaD
enabled)
Information:
This counter should be counted as difference with
a threshold greater than 0.
Total Worker Description:
Process Star- This displays the number of times that Windows
tup Failures
Process Activation Service (WAS) failed to start a
worker process.
Information:
This counter should be counted as difference with
a threshold greater than 0.
766
> 0 (CaD
enabled)
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
767
Counter
Expert Knowledge
Current
File
Cache
Memory
Usage
Description:
This displays the current number of bytes used by the user-mode
file cache.
Information:
The value of this counter and the value of Web Service Cache
and Maximum File Cache Memory Usage should be the same.
768
Possible problems:
If the values are different, this means the cache was flushed.
Remediation:
If this counter is significantly lower than Web Service Cache and
Maximum File Cache Memory Usage, consider recycling the
worker process because the application might have a memory
leak.
Maximum
File
Cache
Memory
Usage
Description:
This displays the maximum number of bytes used by the usermode file cache since service startup.
Information:
The value of this counter and the value of Web Service Cache
and Current File Cache Memory Usage should be the same.
Possible problems:
If the values are different, this means the cache was flushed.
Remediation:
If this counter is significantly higher than Web Service Cache and
Current File Cache Memory Usage, consider recycling the
worker process because the application might have a memory
leak.
Output
Cache
Current
Memory
Usage
Description:
This displays the current number of bytes used by the output
cache.
File
Cache
Hits
Description:
This displays the total number of successful lookups in the usermode file cache since service startup.
Information:
Understanding this output depends on the content. For example, if
the content files cannot be cached by HTTP.sys, a high value is
good
769
File
Cache
Misses
Description:
This displays the total number of unsuccessful lookups in the usermode file cache since service startup.
Information:
A file cache miss means the request for the file must go to the hard
disk.
Possible problems:
File cache misses negatively impact performance and scalability.
This value should be as low as possible. Also note that kernel
cache hits will cause this value to be low.
Metadata
Cache
Hits
Description:
This displays the total number of successful lookups in the usermode metadata cache since service startup.
Metadata
Cache
Misses
Description:
This displays the total number of unsuccessful lookups in the usermode metadata cache since service startup.
Information:
This value should be as low as possible.
Output
Cache
Total Hits
Description:
This displays the total number of successful lookups in the output
cache since service startup.
Output
Cache
Total
Misses
Description:
This displays the total number of unsuccessful lookups in the output cache since service startup.
URI
Cache
Hits
Description:
This displays the total number of successful lookups in the usermode URI cache since service startup.
Information:
Understanding this output depends on the content. For example, if
770
Description:
This displays the total number of unsuccessful lookups in the usermode URI cache since service startup.
Information: A low value is preferable. The value of this counter
increases when IIS cannot locate the requested content in either
the HTTP.sys response cache or the IIS file cache, and must locate
the requested content on the hard disk.
Possible problems:
If the value of this counter is high, IIS locates the requested content
on the hard disk which could slow overall performance.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
the amount of data currently loaded into the chart. This can be changed by
clicking Edit from within the resource.
Note: The Value from Last Poll column shows the most recent data available for
the listed statistic.
Worker Process Details
This resource provides details concerning the listed worker process. Clicking
>>View Details will take you to Worker Process Statistic Monitor Details page for
additional information.
771
l
l
l
l
772
Counter
Expert Knowledge
Active Requests
Description:
Current number of requests being processed by the worker
process.
Requests/sec
Description:
HTTP requests/sec being processed by the worker
process.
Active Thread
Count
Description:
Number of threads actively processing requests in the
worker process.
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart. The time and date displayed at the top of the resource shows
773
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
774
775
776
777
are some of the more common reasons why this error message might be returned
by Windows:
E.G. Restart the remote registry service, check that TCP port 445 is open between
the Orion server and the remotely monitored IIS server.
When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
Node Unreachable.
Error: Credentials test failed. Node is unreachable.
Resolution: Ensure the node is currently being managed. For more information,
see Unmanage Scheduling Utility. When complete, rerun the AppInsight for IIS
Automatic Configuration Wizard.
778
IISVersion Failed
IISVersion Failed
Error: The current version of IIS is 6.0. Version 7.0 or higher is required.
Resolution: Install IIS version 7.0 or higher. When complete, rerun the AppInsight
for IIS Automatic Configuration Wizard.
779
780
4. Ensure that the group to which the polling user belongs has access to
Microsoft PowerShell.
781
5. Click OK.
Error Code 1367
Error: Incorrect user name and/or password.
Resolution: Enter a valid user name and password combination. When
complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
782
783
784
785
786
787
Resolution: Try to lower the User Account Control settings on remote IIS server.
Also check that the user account has privileges to run executable files. When
complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
788
are some of the more common reasons why this error message might be returned
by Windows:
l
789
790
791
&
RemoteIISConfiguratorPowerShell.log). For configuring WinRM using a
different port, see An HTTPS listener currently exists on port 5986:
\ProgramData\Solarwinds\Logs\APM\RemoteIISConfigurator.log
792
793
794
795
796
797
798
Other Errors
7. Check the box next to Windows PowerShell 2.0 Engine.
8. Click Next and then Install.
9. When the installation finishes, click Close.
Other Errors
Issue:PowerShell 2.0 is not Installed
Resolution: Install PowerShell.
Installing PowerShell 2.0 on Server 2008:
For Server 2008, download the installation file for PowerShell 2.0 at
http://support.microsoft.com/kb/968929/en-us and install it on the
server.
Note: PowerShell 2.0 is automatically installed on Server 2008 R2
and therefore no additional installation is required.
Installing PowerShell 2.0 on Server 2012:
1. Open Server Manager.
2. Click on the Manage menu, and the select Add Roles and
Features.
3. After the wizard opens, click Next until you get to the Installation
Type page.
4. Select Role-based or feature-based installation.
5. Click Next until you reach the Features page.
6. Scroll down to Windows PowerShell. It will likely show itself as
partially installed (square inside box).
7. Check the box next to Windows PowerShell 2.0 Engine.
8. Click Next and then Install.
9. When the installation finishes, click Close.
Setting the appropriate permissions for PowerShell on the target
server:
1. On the remote computer, open the PowerShell console.
2. Execute the following PowerShell command: Set-PSSessionConfiguration Microsoft.PowerShell -ShowSecurityDescriptorUI -force
appear.)
3. Uncheck the Deny check box to enable the Full Control option
under the Permissions for Everyone group.
799
4. Ensure that the group to which the polling user belongs has
access to Microsoft PowerShell.
800
Other Errors
5. Click OK.
6. When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
Issue: PowerShell WebAdministration snapin is not installed.
Information: For legacy systems with IIS 7.0 (Windows Vista, Windows 2008)
PowerShell WebAdministration snapins are not part of IIS.
Resolution: Download and install the PowerShell WebAdministration snapins
found at the following link: http://www.iis.net/downloads/microsoft/powershell
When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
801
802
where the NewValue will be the desired memory limit. If the error persists,
the value should be increased again.
An HTTPS listener currently exists on port 5986:
Important: If you received the following error: An HTTPS listener currently exists
on port 5986, use the following steps to configure the listener on an available port
by changing 5986 to an available port number throughout these steps.
1. To configure WinRM on a server, open a command prompt in the Run as
Administrator context.
2. Type: winrm create winrm/config/listener?Address=*+Transport=HTTPS
@{Port="5986";CertificateThumbprint="<Thumbprint value of certificate>";Hostname="<IP Address of Server>_Solarwinds_IIS_Zero_Configuration"}
803
3. Run the function to create the firewall exception for WSMAN using the
following command:
Add-FirewallRule "Windows Remote Management" "5986" $null
804
Event IDs
$null
Event IDs
The matrix below outlines and defines Microsoft event IDs to help aid in
troubleshooting:
Event ID
Source
Log
Severity Message
2281
805
WMSVC
2297
5039
Microsoft- System
WindowsWAS
Warning
5015
Microsoft- System
WindowsWAS
Warning
5127
Microsoft- System
WindowsWAS
Warning
1173
Microsoft- System
WindowsIISW3SVC
Error
1026
Microsoft- System
WindowsIISW3SVC
Warning
1135,
1134
Microsoft- System
WindowsIISWMSVC
Warning
1020
Microsoft- System
Windows-
Warning
806
Event IDs
IISWMSVC
1062
Microsoft- System
WindowsIISWMSVC
Warning
1126
Microsoft- System
WindowsIISW3SVC
Warning
1175
Microsoft- System
WindowsIISW3SVC
Warning
1071,
1073
Microsoft- System
WindowsIISW3SVC
Warning
1087
Microsoft- System
WindowsIISW3SVC
Warning
1086
Microsoft- System
WindowsIISW3SVC
Warning
5067
Microsoft- System
WindowsWAS
Warning
1037
Microsoft- System
Windows-
Warning
807
IISW3SVC
2208
2206
2201
2203
2204
2274,
2268,
2220,
2219,
2214
5088,
5061,
5060
Microsoft- System
WindowsWAS
2227
Warning
808
Event IDs
IISWMSVC
connection
2233
2226,
2230,
2231,
2232
5174,
5179,
5180
Microsoft- System
WindowsWAS
Warning
5085
Microsoft- System
WindowsWAS
Warning
5054,
5091
Microsoft- System
WindowsWAS
Error
5063
Microsoft- System
WindowsWAS
Warning
5058
Microsoft- System
WindowsWAS
Warning
809
5066
Microsoft- System
WindowsWAS
Error
5153
Microsoft- System
WindowsWAS
Warning
5172,
5173
Microsoft- System
WindowsWAS
Warning
5014
Microsoft- System
WindowsWAS
Warning
5101
Microsoft- System
WindowsWAS
Error
5070,
5093
Microsoft- System
WindowsWAS
Warning
5005
Microsoft- System
WindowsWAS
Error
5053
Microsoft- System
WindowsWAS
Warning
2296
Microsoft-
Application Warning
810
Event IDs
WindowsIISW3SVCWP
precondition
2295
2293
1133
Microsoft- System
WindowsIISW3SVC
Warning
2261
SF_NOTIFY_READ_RAW_
DATA filter notification is not
supported in IIS
5036
Microsoft- System
WindowsWAS
2264
2298
Error
811
W3SVCWP
2218
2258
5152
Microsoft- System
WindowsWAS
Warning
5010,
5011,
5012,
5013
Microsoft- System
WindowsWAS
Warning
5009
Microsoft- System
WindowsWAS
Warning
2216
2221
2222
812
Event IDs
IISW3SVCWP
Error
5030
Microsoft- System
WindowsWAS
2279,
2278,
2277
1005
MicrosoftWindowsIISW3SVC
8001
MicrosoftWindowsIISWMSVC
813
Performance Counters
Performance Counter Details
History Chart
814
Performance Counters
Performance Counters
This resource displays all the available performance counters associated with the
current application or database.
815
816
History Chart
l
l
l
l
l
l
History Chart
This resource graphically details the value history of the current performance
counter. Hovering over any time period within the chart will display detailed
information about that time period in the tooltip.
The colors of the main chart correspond to the labels in the legend. You can
choose which data to display by using the check boxes in the legend.
817
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart or manipulating the sliders of the lower chart.
818
Chapter 16:
The AppStack Environment
The Application Stack, or AppStack, is a term used to describe the various layers
that make up a complex application delivery infrastructure. The AppStack
Environment view is an interactive visual mapping within Orion that provides an
in-depth perspective through the entire environment to help identify the root cause
of performance and availability issues.
AppStack will automatically gather information about objects in your environment,
as well as their respective relationships, and display them. Some relationships,
such as groups and dependencies can be defined by the user.
Important: As a standalone product, AppStack is available in the software
versions listed below. If you own two or more of the listed products, AppStack will
not function properly unless each version of the software is upgraded to the
versions listed:
l
l
l
l
819
Now imagine you call in sick and are unable to work for two weeks. Certain
employees in various departments will be affected by your absence. Others will
not be affected. The illustration below highlights the employees who will be
affected by your absence by fading those who are not affected.
820
Focusing on only the people who are affected by your absence can be beneficial
from a task management perspective. Therefore, completely hiding those not
affected by your absence will give a clean and concise view, displaying only the
necessary information.
821
822
Clicking Spotlight removes the faded, unrelated objects from the view entirely.
823
Clicking the selected object at the top, or double-clicking it in the view, will take
you to the Details page for that object for further investigation.
Storage
Resource Monitor
(SRM)
Server
&Application Monitor
(SAM)
Virtualization
Manager
(VMan)
Groups
Web Performance
Monitor
(WPM)
Definition
Groups
enable you
to more
effectively
824
manage
your environment by
giving you
the ability to
logically
organize
monitored
objects,
regardless
of device
type or location.
Applications
In SAM, an
application
is a collection of
component
monitors
grouped
together to
collect specific metrics
concerning
the application as a
whole.
Transactions
A transaction is a
recording of
web
browser
steps
assigned to
a specific
location.
825
Steps
A step is a
collection of
actions. For
example,
the actions
required to
navigate to
a specific
URL make
up one
step.
Servers
A server is
a computer
capable of
accepting
requests
from the
client and
giving
responses
accordingly.
The server
makes
services, as
access to
data files,
programs,
and
peripheral
devices,
available to
workstation
s on a
network.
Hosts
A Host is
826
defined as
a server running a
Hypervisor
for virtualization.
(E.g. It
hosts multiple virtual
machines.)
Virtual
Clusters
Virtual
clusters are
built with
VMs
installed at
distributed
servers
from one or
more physical
clusters.
The VMs in
a virtual
cluster are
logically
connected
by a virtual
network
across several physical
networks.
Each virtual
cluster is
formed with
physical
827
machines
or a VM hosted by multiple
physical
clusters.
Virtual Datacenters
A virtual
datacenter
is a centralized virtual
repository
for the storage, management,
and dissemination
of data and
information
organized
around a
particular
body of
knowledge
or pertaining to a
particular
business.
Virtual
Centers
A VMware
virtual center
(vCenter)
server is a
centralized
man-
828
agement
application
that lets you
manage virtual
machines
and ESXi
hosts centrally. The
vSphere client is used
to access
vCenter
Server and
ultimately
manage
ESXi servers.
A data store
is a repository of a set
of data
objects.
These
objects are
modeled
using
classes
defined in a
database
schema. A
data store is
a general
concept that
includes not
just repos-
Data Stores
829
itories like
databases,
but also simpler store
types such
as flat files.
Some data
stores represent data
in only one
schema,
while other
data stores
use several
schemas for
this task.
Volumes
A volume,
or logical
drive, is a
single
accessible
storage
area with a
single file
system, typically resident on a
single partition of a
hard disk.
LUNS
A Logical
Unit Number, or LUN,
is a number
830
used to
identify a
logical unit,
which is a
device
addressed
by the SCSI
protocol or
Storage
Area Network protocols
which
encapsulate
SCSI, such
as Fibre
Channel or
iSCSI. A
LUN may
be used
with any
device
which supports
read/write
operations,
such as a
tape drive,
but is most
often used
to refer to a
logical disk
as created
on a SAN.
Network-
NASVolumes
831
attached
storage
(NAS) is a
type of dedicated file
storage
device that
provides
local-area
network
(LAN) users
with centralized, consolidated
disk storage
through a
standard
Ethernet
connection.
A storage
pool (also
called a
RAID array
) is a
collection of
disk drives
that
become a
logical
entity.
When you
create a
storage
pool, you
select the
desired
Pools
832
capacity
(number of
disk drives)
and assign
a RAID
level to it
which will
provide a
redundancy
level.
VServers
A virtual
storage
server
(VServer)
contains
data
volumes
and one or
more LIFs
through
which it
serves data
to the
clients. A
VServer
can either
contain one
or more
FlexVol
volumes, or
a single
Infinite
Volume.
A VServer
securely
833
isolates the
shared
virtualized
data
storage and
network,
and
appears as
a single
dedicated
server to its
clients.
Each
VServer
has a
separate
administrat
or
authenticati
on domain
and can be
managed
independen
tly by a
VServer
administrat
or.
In a cluster,
a VServer
facilitates
data
access. A
cluster must
have at
least one
834
VServer to
serve data.
VServers
use the
storage and
network
resources
of the
cluster.
However,
the volumes
and LIFs
are
exclusive to
the VServer.
Multiple
Vservers
can coexist
in a single
cluster
without
being
bound to
any node in
a cluster.
However,
they are
bound to
the physical
cluster on
which they
exist.
Storage
Arrays con-
Storage
Arrays
835
sist of two
or more
disk drives
built into a
stand-alone
unit. Storage arrays
provide
increased
availability,
resiliency,
and maintainability
by using
existing
components
(controllers,
power supplies, fans,
and so on)
often up to
the point
where all
single
points of failure are eliminated from
the design.
Understanding AppStack
AppStack contains multiple tools and features. Following is a detailed description
for each of these tools and features.
l
l
l
l
836
Understanding Categories
Understanding Filtering Options
Understanding Filter Properties
Understanding Layouts
Color
Down
Red
Critical
Pink
Warning
Yellow
Unknown
Gray
Unreachable
Black
Up
Green
Other
Blue
External
Purple
Example
Note: Statuses only become available for filtering when an object in your
environment is in that state. For example, if no objects have a status of Down, the
Down status will not be available when filtering.
Status Reporting
Servers can only provide an Up or Down status. To check CPU, memory, or
hardware health status, hover the mouse over the server icon to view the detailed
tooltip. The reported status for applications and LUNs is based on performance
thresholds.
Understanding Mixed Icons
The AppStack Environment view offers a parent/child relationship. (Parents can
be either servers or hosts.) This relationship is represented as a mixed icon. The
parent is the larger of the two icons that is hosting the child. For example, the
837
Expand All: Opens all categories, revealing the visible objects within each
category.
Note: Each category can be individually expanded and collapsed by clicking [+] and [-] next to the category name.
Collapse All: Closes all categories, hiding the objects within each category.
Note: Each category can be individually expanded and collapsed by clicking [+] and [-] next to the category name.
838
Show/Hide Names: Allows you to toggle between showing and hiding the
names for each object that is in a distressed state.
Note: If more objects exist than are allowed to be displayed on the screen,
the category name will display the number of displayed objects followed by
the total number of objects. For example, (87 of 111), meaning only 87
objects of 111 total objects in this category are being displayed. This
provides a numerical summary of your environment. Clicking More (located
after the last visible object in the category) will display, by default, an additional 50 objects that are hidden from view. Related objects may be found
by clicking More. The default number of 50 can be changed in the Settings
page. For more information, see Customizing the AppStack Environment
View.
839
Understanding Categories
By default, the following AppStack Environment categories are available within
Server & Application Monitor.
l
l
l
l
l
l
l
l
Groups
Applications
Servers
Virtual Hosts
Virtual Clusters
Virtual DataCenters
Virtual Centers
Volumes
Notes:
l
l
840
The doughnut chart in the Overview section graphically displays the ratio of
objects to one another in all possible states using indicative colored slices. The
total number of objects in your environment is also displayed.
Objects under the Issues header are parsed and enumerated according to status.
Objects shown here will be in one of the following distressed states: Down,
Critical, Warning, Unknown and Unreachable. An icon and count will only appear
if at least one object is currently in that state.
841
Note: Statuses only become available for filtering when an object in your
environment is in that state. For example, if no objects have a status of Down, the
Down status will not be available when filtering.
842
3. From the pop-up menu, select an object from the Orion Object drop down
list:
843
Note: If no relations are shown in the AppStack resource on the Group Details
view, then it is likely that this group contains no objects represented within the
AppStack, such as switches, routers, and so on. If you have created a group that
844
Understanding Layouts
contains only objects which have no representation within the AppStack
environment (e.g.: Nodes that are switches, routers, wireless access points,
interfaces, and so on) then they will not have relationships and the only item
displayed within the AppStack resource on the Group Details view is the group
itself. This is normal behavior. Servers and virtual servers are the only node types
that are represented within the AppStack environment. Groups made up of other
object types which are not supported by the AppStack environment will not
appear within the AppStack resource.
For more information, see Understanding Filtering Options.
Understanding Layouts
A Layout is a user-defined filter (view-limitation), along with settings, that can be
saved and recalled later within the Appstack Environment view. User-defined
layouts can be used to tailor the AppStack Environment view to specific objects of
interest. A default layout is provided and contains all objects visible in the
AppStack Environment that is currently being monitored. The default layout
cannot be modified.
New layouts are created by first filtering your environment, and then saving the
changes via the Save As New Layout action in the Layout menu.
For example, to create a Layout where only IIS objects in the AppStack
Environment view are shown, add the IIS filter property, apply the filter, then save
it as a new layout, naming the layout appropriately.
845
Once saved, the layout is added to the drop down menu, allowing you to easily
navigate to that layout with its defined filter and settings. The dot to the left of the
name of the layout in the menu represents the layout currently in use, as shown:
846
847
Navigating AppStack
Navigating to the AppStack Environment view:
1. From the web console, navigate to Home >Environment.
848
Using AppStack
Using AppStack
Using AppStack as a troubleshooting tool is fairly straightforward. Simply
navigate to the AppStack Environment view, and then click on an object to see
what is related to that object. To investigate further, navigate to the Details page
of the object or any related object.
For example, the illustration below displays all objects in the current environment.
The application, MSSQLSERVER, is in a Critical state, as indicated by its icon.
To see what this application is related to, click the MSSQLSERVER icon.
849
To hide the unrelated objects completely from view, take the following step:
1. Once an object is selected, click Spotlight in the upper right-hand corner of
the view.
To navigate to the details page of an object for further investigation, take the
following steps:
1. Click the icon of the selected object to the left of the doughnut chart, or
double-click the larger icon in the main view.
850
2. From the Details page, you can now investigate the cause for the Critical
status.
For more information, refer to the following sections:
l
l
l
851
852
853
854
855
l
l
l
l
l
Allows for polling host and applications behind firewall NAT or proxies
Polling node and applications across multiple discrete networks that have
overlapping IP address space
Allows for secure encrypted polling over a single port
Support for low bandwidth, high latency connections
Polling nodes across domains where no domain trusts have been established
Full end to end encryption between the monitored host and the Orion poller
During a network outage, the agent continues monitoring the server and its
applications, regardless of whether or not it can communicate with the
poller. Once connectivity to the poller is restored, the agent then forwards
the results of its monitoring during the outage to the poller for processing. All
gaps in the data will be filled with the data collected by the agent.
The agent allows you to monitor servers hosted by cloud based services such as
Amazon EC2, Rackspace, Microsoft Azure, or virtually any other Infrastructure as
a Service (IaaS).
Once deployed, all communication between the Orion server and the agent occur
over a single fixed port. This communication is fully encrypted using 2048 bit TLS
encryption. The agent protocol supports NAT traversal and passing through proxy
servers that require authentication.
When using the agent with SAM, data from all application monitors for that server
will then be collected by the agent. You can override this behavior in certain
instances. For example, you may assign an application template that uses a User
Experience Monitor. Measuring response time locally from the server where the
application is installed may not desired. If this is the case, you can switch the
application to poll without using an agent. This can be configured at both the
application and template level.
856
Agent initiated Communication (Active): The Agent initiates communication with the server on the default port of 17778. (This can be
changed if needed.) This port must be opened on the server firewall so the
Agent can connect. No change to the Agent firewall is required.
For more information, see:
l Agent-Initiated (Active) Communication.
l Agent Requirements
Orion Server initiated Communication (Passive): The Agent waits for
requests from the server on the default port of 17790. (This can be changed
if needed.) This port must be opened on the Agent computer's firewall so the
server can connect. No change to the server firewall is required. For more
information, see Orion Server-Initiated (Passive) Communication.
For more information, see:
l Orion Server-Initiated (Passive) Communication
l Agent Requirements
The following reports are installed for use with the Agent:
l
l
Agent Inventory
Agent Plugin Version
For more information, see Predefined Server & Application Monitor Web Console
Based Reports
For information about using agents, please refer to the following sections:
l
l
l
Agent Requirements
Deploying an Agent
Agent Settings
857
Agent Requirements
l
l
Managing Agents
Troubleshooting Agents and Deployment
Agent Requirements
Supported Operating Systems:
l
l
l
l
l
l
l
Note: Workstation operating systems are only supported with the Pro, Enterprise,
and Ultimate editions.
Agent Prerequisites:
The following prerequisites are self-satisfied by the agent installer. No user
action is required to satisfy any agent prerequisites.
l
l
Notes:
l
l
l
Important: Polling via the JMX Component Monitor is not supported using an
agent.
Agent Resource Consumption:
The following list details agent resource consumption:
l
858
l
l
Agent Licensing
Agent software is free. You remain bound by the limits of the license you own
regardless of how information is polled, either via an agent or another protocol.
For more information, see:
l
l
l
Deploying an Agent
Agent Settings.
Licensing
17778 (Active mode):In Active mode, no ports need to be open on the host
where the agent is installed. However, TCP port 17778 must be open on the
Orion server or the additional poller with which the agent is associated. This
port must be opened on the Orion server (inbound) and allowed by the firewall. It is used on a continual basis once the agent has been deployed.
Communication is initiated outbound from the agent to the Orion server.
Important: This requirement is for Active agents only. If Passive agents are
used, no ports need to be opened on the firewall for the Orion server. For
more information, see Changing the Agent Port.
859
Requirements for Remote Deployment from the Orion Server:Note: Other remote
l
The account used for remote deployment must have access to the administrative share on the target computer: \\<hostname_or_ip>\admin$\temp
User Account Control (UAC) must either be disabled, or the built in Administrator account must be used.
An installed agent occupies less than 100 MB of hard drive space
Open Ports Requirements for Remote Deployment from the Orion
Server:
l
860
861
Agent Discovery
Agent Discovery
Agent discovery allows you to keep nodes that utilize the agent up to date.
Checking this box allows the Orion server to find new volumes, interfaces, and
other objects on nodes that use the agent.
862
863
5. Choose credentials for installing the agent from the Credential Library or
enter new credentials (User name and Password). After installation, local
system credentials will be used.
6. Optionally Test the credentials, then click Next.
a. If the agent is already installed, clicking Next in this step will take you
to the Choose Resources page (Step 7).
b. If the agent is not installed, you will be prompted to install the agent
after you click Next.
i. During agent installation, you will have the option to navigate to
the Manage Agents page.
If you choose to navigate to the Manage Agents page, a notification banner will inform you when the agent installation has
864
8. Review the Properties screen and make changes as needed. When done,
click OK, Add Node. Once added, you will be notified via the notification
banner when agent deployment is complete.
Status & Response Time
There are two Status & Response options available with the agent when
choosing resources. These options allow you to choose how you would like data
collected for the following: Response Time, Packet Loss, and Availability.
l
865
866
4. Turn on .NET 2.0 layer for WoW64 by entering the following command:
Start /w ocsetup NetFx2-ServerCore-WOW64
Deploying an Agent
Orion supports three methods of deploying an agent to a client computer running
Windows:
1. Have the Orion Server push the agent software to one or more client computers
2. Mass deploy the agent software to multiple computers using a mass-deployment technology such as Group Policy
3. Manual installation of the agent on a client computer
For more information, refer to the following sections:
l
l
l
l
l
l
867
c. Click Deploy Agent. At this point, Orion is going to install the agent
software
Connect to a Previously Installed Agent:
This action allows you to connect to agents that have been configured with
Orion Server Initiated communication or if Allow Automatic Agent
Registration has not been enabled. When you connect to an agent, you
first need to select the communication mode that was chosen when the
agent was installed. If the communication mode is server-initiated (passive),
a passphrase (shared secret) was required during installation. This
passphrase needs to be re-entered here.To connect to a previously
installed agent, complete the following steps:
a. On the Add Agent page, enter a name for the Agent.
b. Select the agent communication mode.
c. For Server Initiated Communication (Passive), take the following
steps:
i. Enter the IPaddress or hostname where the agent is located.
ii. Enter the passphrase (shared secret).
iii. You can optionally expand Advanced and adjust the following
as needed:
A. Change the agent port number. (This is the port the agent
uses for listening.)
B. Use a proxy by checking its box and selecting a Proxy and
entering its Proxy URL in the fields provided.
869
870
3. Download both the .MSI installer file and the .MST transform file.
Note: If you prefer to install the agent silently, take the following optional
two steps:
Installing the agent silently using the .MST:
871
4. Once download is complete, copy the .MSIfile to the client machine and
then install it by double clicking it and beginning the wizard.
5. During installation, select either Agent Initiated Communication (Recommended) or Orion Server Initiated Communication. When done, click
Next.
6. Enter the Orion server IP address or Hostname and the Orion administrator account credentials (Username and Password) during installation.
872
873
.
a. The Use Connection Details from Polling Engine determines with
which polling engine the agents will register. If this option is selected,
select the connection details for the polling engine.
b. The IP address may be different than the IP address known to Orion in
instances where the host being monitored is behind a NAT or proxy
device. In these cases, enter the IP address of the Orion server or the
additional poller as it is accessible from the host where the agent will
be installed. To do this, select Enter Connection Details Manually.
c. Enter the host name and IP address of the polling engine as seen by
the client computers. The polling engine information defined here will
874
875
876
9. From the Deployment tab, check the Deployment type/Deployment options as shown. (Note: Your deployment type/options
may be different depending on your network).
10. From the Modifications tab, select your MST file from the network
share, as shown:
877
878
879
3. From the SolarWinds, Inc. Packages Action Pane, click New Package. This
will launch the Patch Manager Package Wizard.
Value
Comments
880
Agent (Version
Number) MSI
Description:
SolarWinds Orion
Agent
Classification: Tools
Vendor:
SolarWinds, Inc.
Product:
Severity:
None
Impact:
Normal
Reboot Behavior:
881
882
883
884
b.
c. For the Comparison, select Equal To.
d. For the Version, enter the version number for the agent. (For example:
1.0.0.866).
18. Click OK to save the rule, then click Next. Review the Summary Page and
enter any notes at the bottom.
885
886
3. Accept the default selections, or choose a specific WSUS server for publication.
4. Click Next.
5. You will be notified that the package has been published.
887
888
3.
4.
5.
6.
7.
889
Agent Settings
5. Enter the IP address of the node where the agent is deployed as well as the
port number for the agent (Default value is 17790.)
6. Click Submit.
Agent Settings
The Agent Settings page provides access to all of the settings and tools needed
to install and manage agents. Additional agent settings can be found in the
Control Panel. For more information, see Editing Agent Settings in the Control
Panel.
Navigating to the Agent Settings page:
1. From the web console, navigate to Settings > Agent Settings.
Manage Agents: Opens the Manage Agents page from which you can add
a new agent, edit, update, or reboot an existing agent. For more information,
see Managing Agents
Download Agent Software: Opens the Agent Downloads page from which
you can mass deploy or manually install an agent. For more information,
see Deploying Agent Software via Orion Server Push.
Define Global Agent Settings: Opens the Global Agent Settings page from
which you can allow automatic agent registration and/or allow automatic
agent updates.
890
a. Allow Automatic Agent Registration: Selecting this option will automatically register the agent, verifying communication with the Orion
Server. If this option is disabled, you can register any waiting agents
by navigating to Settings > Manage Agents > Add Agent > Connect
to a previously installed agent.
b. Automatically Create Node: Agents will automatically be registered
as Orion nodes.
c. Allow Automatic Agent Updates: Selecting this option will allow the
agent software to be automatically upgraded when updates become
available. This process pushes a new version of the agent to client
machines over the agent communication channel (no extra ports or
permissions are needed). Once the agent receives the new version, it
updates itself to the newer version. This process does not require
rebooting.
Note: If automatic updates are disabled and a new version of the software is installed on the server, it is possible that outdated agents will
not be able to communicate with the server. Ensure that all agent versions match the version of the server.
d. XX Hours: Allows you to control the length of time the agent will be
displayed as being new in the Manage Agents table.
For more information, see
891
Managing Agents
l
l
l
Managing Agents
Most tasks related to managing agents can be done from the Manage Agents
page. From this page, you can check agent connection and deployment status.
Important: ICMP is a low level messaging protocol. Because of its simplicity, it is
not possible to accurately record the same response time values using a different
protocol. For example: An agent node reports a response time in the range 490850 ms, but typical ICMP response time is about 150 ms.
Navigating to the Manage Agents page:
1. From the web console, navigate to Settings > Manage Agents.
Note: Agents that are on devices which are managed nodes and being
polled via the agent will display the node icon. Agents that are on devices
which are not managed in Orion, or which are managed but using a different
polling method (e.g. WMI, SNMP), will display the agent icon.
The available columns for the Manage Agents page are listed in the following
table:
Agent/Node Displays the name or IP address of the listed node.
Agent
Status
892
l
l
Connection
Status
Connected/OK: Connected
Unknown: The agent management service is not running
Service not Responding: The agent management service is running, but the agent is not connected
Deployment Pending: An agent deployment is going to
start, but has not started
Deployment In Progress: The agent is being deployed to
the target node
Deployment Failed: Agent deployment failed for various
reasons
Invalid Response: The status displayed if the agent
responds in an unexpected manner
Waiting for Connection: The agent was approved, but
has yet to connect to the Orion Server
Registered
On
Displays the time and date the agent was first registered with
the Orion server.
Mode
Version
893
Managing Agents
The following tools for the Manage Agents page are listed below:
Manage Agent Toolbar:
l
Add Agent: Takes you to the Add Agent page, allowing you to choose to
deploy the agent on a network, or connect to a previously installed agent
Edit Settings: Takes you to the Edit Agent Settings page, allowing you to
adjust the agent name and automatic updating
Delete: Allows you to delete the selected agent. Deleting an agent from
within this toolbar or the Manage Nodes page provides you the option to
remotely uninstall the agent. For more information, see Managing Nodes
from the Web ConsoleUnmanaging Nodes
Choose Resources: This is only available for agents that are also nodes.
l For a Single Agent: This will take you to the List Resources page,
allowing you to choose items on the node you wish to monitor.
l For Multiple Agents: From here, Orion will discover available
resources on the agents you have selected using Network Sonar Discovery. From here, you can choose items on the nodes you wish to
monitor.
Manage as Node: This will manage the agent as a new node by navigating
to the Add Node page with pre-configured agent details.
More Actions: Provides a drop down list with the following available
actions:
l View installed agent plug-ins: Displays a dialog detailing the following: Node, Agent Status, Connection Status, Plug-in, Status, and
Plug-in version.
l View installed plug-ins report: Generates a report detailing the following: Node Status, Agent DNS Name, Automatic Update enabled,
Connection Status, Agent Status, Agent Version, Plugin, Plugin
status, and Plugin Version.
l Retry agent installation: Will attempt to install the agent in the event
of a file transfer timeout due to network connectivity issues.
l Reboot agent machine: This will reboot the server that hosts the
selected agent.
Note: This option only becomes available should the agent be in a
pending reboot state.
l Update: This will update the agent software to the latest version available.
Note: This button is disabled by default. It becomes enabled when:
l Automatic updates for the agent is disabled
l The selected agent requires an update.
894
Reconnect to passive agent: For Passive agents, the server will try
to re-establish the connection to the passive agent in the event the connection was lost and automatic reconnection failed. This can also be
used for connecting to an agent that was deleted but not uninstalled.
2. Double-click the Orion Agent Settings icon. the following screen appears:
3. Select and Agent Communication Mode:
a. Agent initiated Communication: Also known as an Active Agent.
895
896
897
Agent Alerting
(passive agent) refer to the following SolarWinds article: SWKB5346.
Agent Alerting
There are no predefined alerts for agents; however, when creating a new alert,
options to alert on agents do exist., as shown
898
899
900
901
902
903
2. Change the port number in the following tag to the desired port number:
<agentManagementServiceConfiguration messagingPort="17778" />.
3. Save your changes. Once the port is changed, the agent can start using the
new port number.
4. Restart the SolarWinds Orion Module Engine service.
Notes:
l
If you installed the agent manually, you can change the port number during
installation through the wizard in the web console.
If you deployed the agent from the server, the port number is set automatically.
If you used the .MST file for deployment for mass-deployment, you will need
to download a new .MST file from the server after the port number was
changed.
904
905
2. Navigate to the Agent Management page and delete the Agent record:
a. From the web console, navigate to Settings >Manage Agents.
b. Check the box next to the Agent you want to uninstall, and then click
Delete on the toolbar. Confirm deletion when prompted.
3. Install the Agent in the desired mode.
a. From the web console, navigate to Settings >Manage Agents >Add
Agent > Deploy the agent on my network.
b. Select the desired node by checking its box, then click Next.
c. Assign credentials then select the agent mode, Active or Passive.
l Active: The Agent initiates communication with the server on
the default port of 17778. (This can be changed if needed.) This
port must be opened on the server firewall so the Agent can connect. No change to the Agent firewall is required.
l Passive: The Agent waits for requests from the server on the
default port of 17790. (This can be changed if needed.) This port
must be opened on the Agent computer's firewall so the server
can connect. No change to the server firewall is required.
906
907
908
909
On the Add Agent page, enter the name of the agent you want to connect to.
Select the agent from the Agent drop-down list.
To view the poller, click Advanced.
Select Allow automatic agent updates to have the agent automatically
upgraded when upgrading to new versions of Orion modules that support
the agent.
Note: Disabling this option will require you to manually upgrade agents
after upgrading your Orion products and modules.
5. Click Submit to complete the process.
When the connection is successful, the agent will appear in the agent list on the
Manage Agents page.
910
Messages Sent: This counter displays the number of messages sent to the
Agent Management Service.
Messages Received: This counter displays the number of messages
received from the Agent Management Service.
Exchange Received: This displays the number of times the Exchange
Receive method was called.
Exchange Sent: This displays the number of times the Exchange Send
method was called.
l
l
l
l
l
l
911
912
913
914
915
916
Agent Alerting
There are no predefined alerts for agents; however, when creating a new alert,
options to alert on agents do exist., as shown
917
Agent Alerting
918
Chapter 18:
Alerting and Reporting
Alerts can provide you real time information on that status of all of your systems,
allowing you to take corrective action before a system fails. Reports provide an
on-demand summary of your environment and can be tailored to suit your specific
needs.
The following sections provide an in-depth look into the alerting and reporting
capabilities built into SolarWinds Server & Application Monitor.
Refer to the following sections for more information:
l
l
l
Alerting
Introduction to the Alert Wizard
Web Console Based Reports
Alerting
SolarWinds Server & Application Monitor provides application and component
alerts you can use with SolarWinds Alert Manager in the web console to actively
monitor and respond to detected issues.
For more information, see:
l
l
l
l
l
l
l
l
l
l
l
Understanding Alerts
Managing Alerts
Managing Actions
Adding Alerts
Introduction to the Alert Wizard
Viewing Alerts in the SolarWinds Web Console
Viewing Alerts from Mobile Devices
Acknowledging Alerts in the Web Console
Understanding Condition Groups
SolarWinds SAM Alerts
Adding Alert Actions
919
Understanding Alerts
Alerts can be useful by informing you of potential problems before the problems
worsen. A variety of alerts exist that can be customized to suit your needs. You
can also create custom alerts based on your specifications. Alerts can be created,
edited, acknowledged, and fully managed via the web console on the Manage
Alerts page.
Some of Alert Manager's capabilities include the following:
l
l
2. Click Manage Alerts in the upper right-hand corner of the web console.
Note: This option only appears for administrators.
920
Managing Alerts
3. The Manage Alerts page appears:
Managing Alerts
SolarWinds Server & Application Monitor employs an easy to use Alert Manager
in order to aid in the editing of alerts.
Managing and Editing Alerts:
1. From the web console, navigate to the Home tab and then click Alerts.
921
2. Click Manage Alerts in the upper right-hand corner of the web console.
3. Click the Alert Manager tab and check the box next to the alert you want to
edit in the Alert Name list, and then click Edit Alert.
Managing Actions
SolarWinds Server & Application Monitor employs an easy to use Action
Manager in order to aid in the editing of alert actions. The Action Manager is
primarily used to Enable, Disable, or Delete, multiple alert actions at one time.
Each action can be edited individually.
922
Managing Actions
Important: If an action is disabled or deleted, that action will not fire when alerts
that use these actions are triggered.
Action Manager Toolbar:
The following toolbar exists for modifying alert actions:
l
l
Edit Action: Once an action is checked, clicking Edit Action opens a dialog allowing you to modify the action.
Note: For help in configuring specific actions, see Adding Alert Actions
Test: Allows you to test the action selected.
Enable/Disable: Multiple actions may be checked, allowing you toggle the
actions between being Enabled and Disabled.
Delete: Deletes the actions that are checked.
2. Click Manage Alerts in the upper right-hand corner of the web console.
3. Click the Action Manager tab and check the box next to the Action you want
to edit in the Action Name list, and then click Edit Action.
923
The following sections introduce you to each section of the Alert Wizard,
providing information about each field:
l
l
l
l
l
l
l
Alert Properties
Trigger Conditions
Reset Condition
Time of Day
Trigger Actions
Reset Actions
Summary
924
Alert Properties
For more information, see Adding Alerts.
Alert Properties
The Properties screen contains basic options and fields concerning the alert.
These fields need to be completed before proceeding to the next screen in the
wizard. Following is a definition for each field:
925
926
Reset Condition
927
928
Trigger Actions
For more information, see Adding Alert Actions.
Trigger Actions
The Trigger Actions screen allows you to define what actions will be taken once
the alert is triggered. Following is a definition for each field:
929
930
Reset Actions
For more information, see Adding Alert Actions.
Reset Actions
The Reset Actions screen allows you to define what actions will be taken once
the reset condition of the alert is triggered. Following is a definition for each field:
931
932
Summary
For more information, see Adding Alert Actions.
Summary
The Summary screen details the conditions and actions for your alert. You can
edit any section of the alert from this screen.
Available Alerts
The following table provides a list of available pre-configured alerts with their
respective definitions.
933
Alert Name
Alert Description
Alert me when a
component goes
down
This alert will write to the event log when a component goes
down and when a component comes back up.
Alert me when a
This alert will write to the event log when a component goes
component goes into warning or critical state and when a component comes
into warning or crit- back up.
ical state
Alert me when a
This alert reports when a server warranty will expire in less
node warranty
than 30 days.
expires in 30 days
Alert me when an
application goes
down
Alert me when an This alert will write to the event log when an application
application goes goes into a warning or critical state and when the applicinto warning or crit- ation comes back up.
ical state
AppInsight for IIS: This alert will notify you when the average execution time
Alert me when the any URL as monitored by AppInsight for IIS exceeds a preAverage Server
defined acceptable limit.
Execution Time for
any URL Exceeds
an acceptable limit
Alert me when the This alert reports when the free space of a volume is less
free space of a
than 5%.
volume is less
than 5%
AppInsight for
Exchange: Alert
me when a replication status
check fails
This alert will write to the NetPerfMon event log when a replication status check fails.
934
Available Alerts
AppInsight for
This alert should be raised when available free space for
Exchange: Alert
mailbox database copy drops below 5%.
me when mailbox
database file is
low on space
AppInsight for
This alert should be raised when mailbox database goes to
Exchange: Alert
warning or critical state.
me when mailbox
database is in
warning or critical
state
AppInsight for
This alert should be raised when a mailbox database
Exchange: Alert
switches to a non-preferred server.
me when mailbox
database is not on
preferred server
AppInsight for
This alert should be raised when the available free space for
Exchange: Alert
the transaction log for a mailbox database copy drops below
me when mailbox 5%.
database transaction log is low
on space
AppInsight for
Exchange: Alert
me when an
application goes
down
AppInsight for
Exchange: Warn
me when database failover
occurs
AppInsight for
SQL: Alert me
935
AppInsight for
This alert should be raised if a database file is running low
SQL: Alert me
on space
when my database file is running low on space
Email me when a
Node goes down
Email me when a
Router reboots
Email me when an This alert will email the specified recipient(s) when an interInterface goes
face goes down.
down
Email me when
This alert will email the specified recipient(s) when an intersomeone shuts
face is shut down.
down an Interface
Group is down
This alert will write to the event log when a group goes
down and when an application comes back up again.
Group is in warn- This alert will write to the event log when a group goes into
ing or critical state warning or critical state and when a group comes back up
again.
Hardware comThis will alert when a hardware component is in a critical or
ponent is in warn- warning state. This is for both Network and Server harding or critical state ware.
High CPU Utilization with Top
10 Processes
936
Available Alerts
devices. It also shows the top ten processes running to help
you troubleshoot why this alert was triggered.
High Packet Loss This alert will write to the SolarWinds event log when packet
loss rises above 40% and when it drops back below 5%.
High Physical
Memory Utilization
with Top 10 Processes
High Response
Time
This alert will write to the SolarWinds event log when the
average response time for a node goes above 200ms and
when the average response time drops back down below
100ms after being above 200ms.
High Transmit Per- This alert writes to the SolarWinds event log when the curcent Utilization
rent percent utilization on the transmit side of an interface
rises above 75% or drops back down below 50%.
High Virtual
This alert reports the percentage of virtual memory being
Memory Utilization used. It also shows the top ten processes running to help
with Top 10 Pro- you troubleshoot as to why this alert was triggered.
cesses
Interface is down
Interface shut
down
IOS Image Family This alert will write the NetPerfMon event log when the IOS
Change
Image family changes.
IOS version
changed
This alert will write to the NetPerfMon event log anytime the
IOS Version changes.
No polling engine This alert is triggered when a polling engine is down or has
update in last 10 not communicated with the Orion database for the last 10
minutes
minutes.
937
Node deleted
Node is down
Node not polled in This alert is triggered when there is no update for a manlast 10 minutes
aged node in the last 10 minutes.
Node polling
failed on last 5
tries
This alert is triggered when the last five polling cycles have
failed.
Node rebooted
This alert will write to the NetPerfMon event log when the
date and time a machine last booted changes.
Restart a service
AppInsight for IIS: This alert will restart any failed IIS Application Pool that is
Restart Failed IIS configured to be "AlwaysRunning". As configured this alert
Application Pool will not trigger for Application Pools that are configured to
start "OnDemand" as these Application Pools stop normally
when not in use, or when the site that is configured to use
the Application Pool has no activity and is dormant.
AppInsight for IIS: This alert will attempt to restart any site that is monitored by
Restart Failed IIS AppInsight for IIS that is found to be in a Stopped state.
Site
Windows Sched- This alert should be raised if the result for the task last run is
uled Tasks: Alert unsuccessful.
me when task last
run result is unsuccessful
Adding Alerts
SolarWinds Server & Application Monitor employs an easy to use Add Alert
wizard in order to aid in the creation of alerts.
Creating and Adding Alerts:
1. From the web console, navigate to Home >Alerts:
938
Adding Alerts
2. Click Manage Alerts in the upper right-hand corner of the web console.
939
8. Next, select the trigger condition by selecting from the drop down fields
provided. The trigger condition is the event that will fire the alert. (For
example: If CPU Load > 90%, then trigger an alert.)
940
Adding Alerts
11. On the Trigger Actions tab, select a trigger action from the pop-up list, and
then click Configure Action.
Note: An action is an event that will be performed when the alert is
triggered.
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
Alert Details
7. Expand Execution Settings.
a. Check either Do not execute this action if the alert has been
acknowledged already (Recommended) or Repeat this action
every X minutes until the alert is acknowledged. If you choose the
latter, specify the frequency to have this action repeated.
8. When done, click Add Action.
Alert Details
To navigate to the Alert Details page, see Viewing Alerts in the SolarWinds Web
Console.
The Alert Details page contains the following resources concerning alert details:
l
l
l
l
l
l
l
Management
Alert Status Overview
Alert Definition Details
History of this Alert on this Object
Other Objects currently Experiencing the same Alert
Top 10 Objects by trigger count of this alert
Alert notes
Management
This resource contains controls that are actionable for the listed alert.
959
960
961
962
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, Last Page, Items on
Page, as shown:
963
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, Last Page, Items on
Page, as shown:
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
964
Alert notes
are: Fist Page, Previous Page, Page Number, Next Page, Last Page, Items on
Page, as shown:
Alert notes
This resource allows you to add and update notes for this alert.
965
2. Select the check box next to an alert and click View Alert Details.
3. You will be taken to the Alert Details page where you can view all information associated with this alert.:
966
967
l
l
968
969
970
Value
None
35
38
15
25
36
23
39
28
22
FTP Monitor
24
27
HTTP Monitor
971
HTTPS Monitor
14
IMAP4 Monitor
13
30
JMX Monitor
49
34
21
31
50
NNTP Monitor
11
16
18
37
POP3 Monitor
12
29
40
SMTP Monitor
10
SNMP Monitor
32
17
972
33
26
42
45
20
WMI Monitor
19
Component Status
This allows you to alert on Critical, Down, Unknown, Up, and Warning
status.
Response Time
This allows you to alert on response time.
Statistic Data
This allows you to alert on statistic data.
Process (Service) Name
This allows you to alert on the process or service name. For example:
dns.exe, or AlertingEngine.
Process Instance Count
This allows you to alert on the instance count of a process.
Percent CPU
This allows you to alert on the percentage of CPU in use of a monitored
process or service.
Percent Physical Memory
This allows you to alert on the percentage of physical memory in use of a
monitored process or service.
Percent Memory Used
973
Application Variable
Macro
Defi
nitio
n
${APM:Application ${N=SwisEntity;M=DetailsUrl}
DetailsURL}
974
Hyp
erlin
k to
the
Appl
icati
on
Deta
ils
pag
e
that
trigg
ered
the
alert,
or
the
Deta
ils
pag
e of
the
appli
catio
n
that
trigg
ered
the
com
pon
ent.
${Availability}
${N=SwisEntity;M=ApplicationAler
t.ApplicationAvailability}
975
Prov
ides
the
statu
s of
the
appli
catio
n.
${ComponentsWithP ${N=SwisEntity;M=ApplicationAler
roblems}
t.ComponentsWithProblems}
Prov
ides
a
com
madeli
mite
d list
of
com
pon
ents
in a
Dow
n,
Unk
now
n,
War
ning,
or
Criti
cal
stat
e.
${ComponentsWithP ${N=SwisEntity;M=ApplicationAler
roblemsFormatted} t.ComponentsWithProblemsFormatte
d}
List
of
com
pon
ents
that
are
not
Up
alon
976
g
with
the
com
pon
ent
statu
s,
form
atted
with
HTM
L
tags.
HTM
L
form
attin
g is
used
for
the
Sen
d email
actio
n to
provi
de
an
impr
oved
app
eara
nce
of
the
977
liste
d
com
pon
ents.
${ComponentsWithP ${N=SwisEntity;M=ApplicationAler
roblemsFormattedH t.ComponentsWithProblemsFormatte
tml}
dHtml}
978
List
of
com
pon
ents
that
are
not
Up
alon
g
with
the
com
pon
ent
statu
s.
For
matt
ed
with
HTM
L
tags
for
even
ts
that
app
ear
on
the
web
cons
ole.
${ComponentsWithS ${N=SwisEntity;M=ApplicationAler
tatus}
t.ComponentsWithStatus}
Prov
ides
a
com
madeli
mite
d list
of all
com
pon
ents
and
their
curr
ent
statu
s.
${ComponentsWithS ${N=SwisEntity;M=ApplicationAler
tatusFormatted}
t.ComponentsWithStatusFormatted}
List
of
com
pon
ents
with
com
pon
ent
statu
s
inclu
ded
979
form
atted
with
html
tags.
Html
form
attin
g is
used
for
send
email
actio
n to
provi
de
impr
oved
app
eara
nce
of
liste
d
com
pon
ents.
${ComponentsWithS ${N=SwisEntity;M=ApplicationAler
tatusFormattedHtm t.ComponentsWithStatusFormattedH
l}
tml}
980
List
of
com
pon
ents
with
the
com
pon
ent
statu
s.
For
matt
ed
with
HTM
L
tags
for
even
ts
that
app
ear
in
the
web
cons
ole.
${ID}
${N=SwisEntity;M=Application.App
licationID}
981
Prov
ides
the
num
eric
appli
catio
n ID
of
the
spec
ific
appli
catio
n.
${LastTimeUp}
${N=SwisEntity;M=CurrentStatus.L
astTimeUp}
Prov
ides
the
date
and
time
the
appli
catio
n
was
last
seen
in an
Up
stat
e.
${Name}
${N=SwisEntity;M=Application.App
licationAlert.ApplicationName}
Prov
ides
the
nam
e of
the
appli
catio
n
that
is
trigg
erin
g the
alert.
${NodeID}
${N=SwisEntity;M=Application.Nod
e.NodeID}
Prov
982
ides
the
num
eric
nod
e ID
of
the
serv
er
on
whic
h the
appli
catio
n is
moni
tore
d.
${SystemSummaryFo ${N=SwisEntity;M=Application.App
rmatted}
licationAlert.SystemSummaryForma
tted}
983
Syst
em
sum
mar
y.
HTM
L
form
attin
g is
used
for
the
Sen
d email
actio
n to
provi
de
an
impr
oved
app
eara
nce
of
the
liste
d
com
pon
ents.
${SystemSummaryFo ${N=SwisEntity;M=ApplicationAler
rmattedHtml}
t.SystemSummaryFormattedHtml}
984
Syst
em
sum
mar
y.
For
matt
ed
with
HTM
L
tags
for
even
ts
that
app
ear
in
the
web
cons
ole.
${TimeStamp}
${N=SwisEntity;M=Application.Cur
rentStatus.ObservationTimestamp}
Prov
ides
the
last
polli
ng
date
and
time
of an
appli
catio
n.
Macro
Defin
ition
${APM:Componen
tDetailsURL}
${N=SwisEntity;M=DetailsUrl}
Hype
rlink
to the
Com
pone
nt
Detai
ls
page
that
trigge
red
the
alert.
985
${ApplicationI
d}
${N=SwisEntity;M=Application.Appli Provi
cationID}
des
the
uniqu
e
nume
ric
identi
fier of
the
appli
catio
n.
This
value
is
analo
gous
to the
node
ID.
${ApplicationN
ame}
${N=SwisEntity;M=Application.Appli Provi
cationAlert.ApplicationName}
des
the
name
of the
monit
ored
appli
catio
n.
${ApplicationS
tatus}
${N=SwisEntity;M=Application.Statu Provi
s}
des
the
statu
s of
986
the
appli
catio
n.
${ComponentId}
${N=SwisEntity;M=ComponentAlert.Co Provi
mponentID}
des
the
nume
ric
comp
onent
ID of
the
speci
fic
appli
catio
n.
${ComponentMes
sage}
${N=SwisEntity;M=ComponentAlert.Co Mess
mponentMessage}
age
sent
when
alerti
ng on
comp
onent
statu
s.
${ComponentNam
e}
${N=SwisEntity;M=ComponentAlert.Co Provi
mponentName}
des
the
name
of the
comp
onen
987
t, for
exam
ple,
SW
Modu
le
Engi
ne.
Provi
des
the
statu
s of
the
speci
fic
comp
onen
t.
${ComponentSta
tus}
${N=SwisEntity;M=Status}
${ComponentTyp
e}
${N=SwisEntity;M=ComponentAlert.Co Provi
mponentType}
des
the
nume
ric
comp
onent
type.
${DisplayType}
${N=SwisEntity;M=ComponentAlert.Di Provi
splayType}
des
the
displ
ay
type
for
the
988
speci
fic
monit
or.
For
exam
ple,
Wind
ows
Servi
ce.
${LastTimeUp}
${N=SwisEntity;M=ComponentAlert.La Provi
stTimeUp}
des
the
date
and
time
the
comp
onent
was
last
seen
in the
Up
state.
${MemoryUsed}
${N=SwisEntity;M=ComponentAlert.Me Provi
moryUsed}
des
the
mem
ory
used
by a
comp
onen
t, in
989
byte
s.
${MultiValueMe
ssages}
${N=SwisEntity;M=ComponentAlert.Mu Mess
ltiValueMessages}
age
sent
when
alerti
ng on
the
Multi
ple
Valu
e
Char
t.
${MultiValueSt
atistics}
${N=SwisEntity;M=ComponentAlert.Mu Statis
ltiValueStatistics}
tics
sent
when
alerti
ng on
the
Multi
ple
Valu
e
Char
t.
${NodeID}
${N=SwisEntity;M=ComponentAlert.No Provi
deId}
des
the
nume
ric
node
ID of
990
the
serve
r on
whic
h the
appli
catio
n is
monit
ored.
${PercentAppli
cationAvailabi
lity}
${N=SwisEntity;M=ComponentAlert.Pe Provi
rcentApplicationAvailability}
des
the
avail
abilit
y of
an
appli
catio
n as
a
perce
ntag
e.
${PercentCompo
nentAvailabili
ty}
${N=SwisEntity;M=ComponentAlert.Pe Provi
rcentComponentAvailability}
des
the
avail
abilit
y of a
comp
onent
as a
perce
ntag
e.
991
${PercentCPU}
${N=SwisEntity;M=ComponentAlert.Pe Provi
rcentCPU}
des
the
amou
nt of
CPU
used
by a
comp
onent
as a
perce
ntag
e.
${PercentMemor
y}
${N=SwisEntity;M=ComponentAlert.Pe Provi
rcentMemory}
des
the
mem
ory
used
by a
comp
onent
as a
perce
ntag
e.
${PercentVirtu
alMemory}
${N=SwisEntity;M=ComponentAlert.Pe Provi
rcentVirtualMemory}
des
the
virtua
l
mem
ory
used
by a
992
comp
onent
as a
perce
ntag
e.
${ProcessInsta
nceCount}
${N=SwisEntity;M=ComponentAlert.Pr Provi
ocessInstanceCount}
des
the
insta
nce
count
of a
proce
ss.
${ProcessName}
${N=SwisEntity;M=ComponentAlert.Pr Provi
ocessName}
des
the
proce
ss
nam
e.
${ResponseTim
e}
${N=SwisEntity;M=ComponentAlert.Re Provi
sponseTime}
des
the
respo
nse
time
of a
comp
onen
t.
${StatisticDat
a}
${N=SwisEntity;M=ComponentAlert.St Provi
atisticData}
des
993
the
statis
tics
data
value
of a
comp
onen
t.
${StatusOrErro
rDescription]
${N=SwisEntity;M=ComponentAlert.St Provi
atusOrErrorDescription}
des
the
statu
s of
the
comp
onen
t,
inclu
ding
the
full
text
of
any
error
mess
ages.
${ThresholdCPU-Critical}
${N=SwisEntity;M=ComponentAlertThr Provi
esholds.ThresholdCPUCritical}
des
the
critic
al
thres
hold
for
994
CPU.
${ThresholdCPU-Warning}
${N=SwisEntity;M=ComponentAlertThr Provi
esholds.ThresholdCPUWarning}
des
the
Warn
ing
thres
hold
for
the
CPU.
${ThresholdPhysicalMemor
y-Critical}
${N=SwisEntity;M=ComponentAlertThr Provi
esholds.ThresholdPhysicalMemoryCri des
tical}
the
Critic
al
thres
hold
for
physi
cal
mem
ory.
${ThresholdPhysicalMemor
y-Warning}
${N=SwisEntity;M=ComponentAlertThr Provi
esholds.ThresholdPhysicalMemoryWar des
ning}
the
Warn
ing
thres
hold
for
physi
cal
mem
ory.
995
${ThresholdResponseTimeCritical}
${N=SwisEntity;M=ComponentAlertThr Provi
esholds.ThresholdResponseTimeCriti des
cal}
the
Critic
al
thres
hold
for
respo
nse
time.
${ThresholdResponseTimeWarning}
${N=SwisEntity;M=ComponentAlertThr Provi
esholds.ThresholdResponseTimeWarni des
ng}
the
Warn
ing
thres
hold
for
respo
nse
time.
${ThresholdStatisticCritical}
${N=SwisEntity;M=ComponentAlertThr Provi
esholds.ThresholdStatisticCritica
des
l}
the
Critic
al
thres
hold
for
statis
tics.
${ThresholdStatisticWarning}
${N=SwisEntity;M=ComponentAlertThr Provi
esholds.ThresholdStatisticWarning} des
the
996
Warn
ing
thres
hold
for
statis
tics.
${ThresholdVirtualMemoryCritical}
${N=SwisEntity;M=ComponentAlertThr Provi
esholds.ThresholdVirtualMemoryCrit des
ical}
the
Critic
al
thres
hold
for
virtua
l
mem
ory.
${ThresholdVirtualMemoryWarning}
${N=SwisEntity;M=ComponentAlertThr Provi
esholds.ThresholdVirtualMemoryWarn des
ing}
the
Warn
ing
thres
hold
for
virtua
l
mem
ory.
${TimeStamp}
${N=SwisEntity;M=CurrentStatus.Obs Provi
ervationTimestamp}
des
the
last
997
pollin
g
date
and
time
of a
comp
onen
t.
${UserDescript
ion}
${N=SwisEntity;M=ComponentAlert.Us Provi
erDescription}
des a
descr
iption
of the
comp
onen
t.
Note:
A
defau
lt
descr
iption
is
given
by
Solar
Wind
s.
Any
chan
ges
you
make
will
overri
998
de
the
defau
lt
descr
iption
and
be
auto
matic
ally
save
d.
${UserNotes}
${N=SwisEntity;M=ComponentAlert.Us Provi
erNotes}
des
notes
from
the
user
about
a
comp
onen
t.
Chan
ges
you
make
will
auto
matic
ally
be
save
d.
${WindowsEvent
${N=SwisEntity;M=ComponentAlert.Wi Full
999
detail
s of
the
corre
spon
ding
even
t.
Messages}
ndowsEventMessages}
${VirtualMemor
yUsed}
${N=SwisEntity;M=ComponentAlert.Vi Provi
rtualMemoryUsed}
des
the
virtua
l
mem
ory
used
by a
comp
onen
t, in
byte
s.
1000
1001
1002
Agent Reports
Generates a hierarchal report grouped by node, application, and component
monitor, that displays memory statistics for each component monitor for the
current month.
Memory Load for each Application Monitor This Year
Generates a hierarchal report grouped by node, application, and component
monitor, that displays memory statistics for each component monitor for the
current year
Page file Usage Last 7 Days
Generates a report that displays page file usage for the last seven days.
Page file Usage Last Month
Generates a report that displays page file usage for the last month.
Page file Usage This Month
Generates a report that displays page file usage for the current month.
Agent Reports
The following reports are predefined for reporting data on installed agents.
Agent Inventory
Generates a report that displays information about all agents.
Agent Plugin Version
Generates a report that displays information about plugins deployed on
individual agents.
Group Reports
The following reports are predefined for reporting historical data for groups.
Current Status of each Group
Generates a report that displays the status of each group.
Current Status of each Group Member
Generates a report that displays the status of each group member.
Group Availability Last Month
Generates a report that displays the availability status of each group for the
last month.
Group Availability This Month
1003
1004
Interface Reports
Current Status of each Hardware Sensor
Generates a hierarchal report grouped by IP address displaying hardware
information about the listed hardware sensor including its name and current
status.
Hardware Sensor Availability Last Month
Generates a report displaying hardware sensor availability for the last
month.
Hardware Sensor Availability This Month
Generates a report displaying hardware sensor availability for the current
month.
Hardware Sensor Availability This Year
Generates a report displaying hardware sensor availability for the current
year.
Interface Reports
The following reports are predefined for reporting historical data for interfaces.
95th Percentile Traffic Rate Last 7 Days
Generates a report displaying interfaces with the highest traffic rates (top
5%) for the last seven days.
95th Percentile Traffic Rate Last Month
Generates a report displaying interfaces with the highest traffic rates (top
5%) for the last month.
95th Percentile Traffic Rate This Month
Generates a report displaying interfaces with the highest traffic rates (top
5%) for the current month.
Average and Peak Traffic Rates Last 7 Days
Generates a report displaying the average and peak traffic rates for
interfaces for the last seven days.
Average and Peak Traffic Rates Last Month
Generates a report displaying the average and peak traffic rates for
interfaces for the last month.
Average and Peak Traffic Rates This Month
1005
1006
Node Reports
Generates a report displaying the total number of bytes that were transferred
over all interfaces for the current month.
Total Bytes Transferred by Node Last 7 Days
Generates a report displaying the total number of bytes that were transferred
for each node for the last seven days.
Total Bytes Transferred by Node Last Month
Generates a report displaying the total number of bytes that were transferred
for each node during the last month.
Total Bytes Transferred by Node This Month
Generates a report displaying the total number of bytes that were transferred
for each node during the current month.
Node Reports
The following reports are predefined for reporting historical data for nodes.
% of CPU by VM for Last 7 Days
Generates a report displaying the percentage of CPU usage for virtual
machines for the last seven days.
% of CPU by VM for Last Month
Generates a report displaying the percentage of CPU usage for virtual
machines for the last month.
% of Memory by VM for Last 7 Days
Generates a report displaying the percentage of memory usage for virtual
machines for the last seven days.
% of Memory by VM for Last Month
Generates a report displaying the percentage of memory usage for virtual
machines for the last month.
All Disk Volumes
Generates a report grouped by node displaying detailed volume
information.
All Down Events
Generates a report displaying events that we down for the last 12 months.
Availability Last Month
1007
1008
Node Reports
Generates a report displaying the next rediscovery and next poll time for
each node.
Device Types
Generates a report displaying the number of device types being monitored.
Down events Windows Devices
Generates a report displaying the Down events for all Windows devices for
the past 30 days.
Down Nodes
Generates a report displaying all nodes that are currently down.
IOS Versions of Cisco Devices
Generates a report displaying the IOS version and image for each Cisco
Device.
Last 100 Audit Events
Generates a report displaying the last 100 audit events.
Last 250 Events
Generates a report displaying the last 250 events.
Last Boot Time for each Node
Generates a report displaying the time of the last reboot for each node.
Network Traffic by VM for Last 7 Days
Generates a report displaying the network traffic of virtual machines for the
last seven days.
Network Traffic by VM for Last Month
Generates a report displaying the network traffic of virtual machines for the
last month.
Node Availability Last Month
Generates a report that displays the availability of each node for the last
month.
Node Availability This Month
Generates a report that displays the availability of each node for the current
month.
Node Availability This Year
1009
1010
Node Reports
Warranty Status Report
Generates a report concerning warranty status.
AppInsight for Exchange Reports
Users By Mailbox Quota
Generates a report displaying the mailbox quota by user.
Users By Mailbox Size
Generates a report displaying the mailbox size by user.
IIS SSL Certificate Expiration Report
Generates a report displaying all certificates monitored by the SSL
Certificate Date Expiration Monitor, the nodes the certificates are assigned
to, their Common Names, the starting and expiration dates of the
certificates, and the number of days remaining until the certificates expires.
Users By Messages Sent This Week
Generates a report displaying the messages sent this week by user.
Mobile Devices
Generates a report displaying information about mobile devices.
AppInsight for SQL Reports
Top Nonclustered Indexes By Fragmentation
Generates a report displaying the top most non-clustered fragmented
database indexes.
Top Clustered Indexes By Fragmentation
Generates a report displaying the top most clustered fragmented database
indexes.
Transaction Log Size by File
Generates a report displaying transaction log file sizes.
Top Tables by Size
Generates a report displaying the largest database tables by size.
Database Size by File
1011
1012
2. Click Manage Reports in the upper right-hand corner of the web console.
3. From the Manage Reports screen, locate a Web-based report as indicated
by the Type column:
4. Check the box next to the name of the report to select it. (In this example,
the All Disk Volumes Inventory Report will be used.)
5. Click Duplicate & Edit on the toolbar above the list of reports.
6. The following screen appears which divides the report into three sections:
Header, Content, and Footer:
1013
1014
Header Section:
Header Section:
The Header section includes the Title, Subtitle, and Logo of your report.
The name of your new report will be based on the Title text. For example, if you
change the Title to read, "My New Report," the name of this report as shown in
the Manage Reports list (see step 3 earlier) will also be "My New Report." A field
is also available for a smaller Subtitle to be entered.
Note: You must complete the wizard for the name change to take effect. If you
click the Back button of your browser before reaching the end of the wizard, your
report will not be saved and the report will be duplicated with its original name in
the Manage Reports list.
Logo
If you decide you want to have a logo in your report, check the Logo box, then
click Browse for Logo to search for your logo. Un-checking the Logo box will
suppress any image you have chosen.
1015
Content Section:
The Content section (in between the header and footer sections) includes the
following content and layout options:
l
l
l
l
l
l
Page Layout
Layout Columns
For drop down (with Edit)
Edit Table
Duplicate
Add Content
Page Layout
The Page Layout option allows you to format your report using a different
combination of columns and rows, as shown:
1016
Page Layout
By selecting the highlighted option above, the layout of the Content section
changes to include a header, footer, and three columns, as shown:
1017
Note: The icon to the left of this field indicates that the current section (in this
case, Content) can be repositioned on the page by dragging and dropping it with
the mouse.
For drop down Menu
Since this is a duplicate of a predefined report, this field is populated by default,
along with the option to add a new data source.
1018
Edit Table
Edit Table
Clicking Edit Table will take you to the Edit Resource screen.
1019
Table Layout
The Table Layout section shows the layout of table by showing the column
headers of the table for the current report. These columns can be repositioned by
simply dragging and dropping them between one another. The repositioning of
columns will be reflected in your report when it is displayed.
1020
Table Layout
Examine the following diagram. The numbers in the illustration correspond to the
numbered explanations below.
1. Click Edit Table to be taken to the Table Layout section on the Edit
Resource screen.
2. Reposition the column heads of the table. Once repositioned, the table will
be displayed in the Content section of your choice.
3. In this example, the table has been placed into the top, full-width column
section. The arrows denote the column heads of the table.
4. You can now view the report with the column heads and table in the
desired layout.
1021
Edit Column Widths: Clicking this link will bring you to the Resource Preview
screen where you can choose automatic column widths, or custom column
widths. Choosing custom column widths will enable you to drag the previewed
column width to your desired location on the report page. When done editing,
click Save Column Widths to save your changes.
Note: Some of the data in the report preview contains live links that will take you
to the details page for that item.
Table Layout (Column Details)
Clicking [+] More Details expands the column head layout to reveal options
concerning the current column, as shown. Conversely, clicking [-] Less Details
hides this information. Clicking will allow you to add additional columns.
1022
The fields displayed here provide you with the following options:
2. Database Column: The database column added to custom table
l Display Name: Allows you to change the text of the column head.
o Hide column by default in web console: Checking this box will
hide the current column.
l Display Setting: Shows the transformation of the display of data in the
column.
l Add Display Setting: drop down selection.
l Data Aggregation: Allows you to choose how the current data is displayed.
l Alignment: Allows you to choose how the data is aligned within the
column,
1023
1024
1025
1026
1027
7.
8.
9.
10.
ii. If you have not already configured an SMTP server, select Add
New Server, and then complete the following steps:
a. Provide the Hostname or IP Address of your SMTP
Server and the designated SMTP Port Number.
Note: The SMTP server hostname or IP address field is
required. You cannot send an email without identifying the
SMTP server.
i. If you want to use SSL encryption for your emailed
report, check Use SSL.
Note: Opting to use SSL automatically changes the
SMTP port number to 465.
ii. If your SMTP server requires authentication, check
This SMTP Server requires Authentication, and
then provide requested credentials.
b. Click Save.
If you selected Print, complete the following steps:
a. Provide a Windows User name, using Domain\Username format, and
Password for a user with access to the printer on which you want to
print your report.
b. Click Printer Settings.
c. Click Select, and then select a Destination printer.
d. Enter the number of Copies, and then select appropriate Layout,
Color, and Margins options.
e. Click Save.
If you selected Save to Disk, complete the following steps:
a. Provide a Network Share Location where you want to save the
report.
i. If you also want a printable version of your saved report, check
Retrieve a Printable Version of Reports.
b. Provide a Windows User name, using Domain\Username format, and
Password for a user with access to the printer on which you want to
print your report.
c. Check the format(s) in which you want to provide the saved report
(PDF, CSV, or Excel).
d. Click Save.
Click Next.
Review the summary, and then click Create.
1028
1029
1030
1031
1032
1033
Android
Apple iOS
Older Blackberry devices)
1034
1035
Introduction
With Quality of Experience, you can:
l
Compare statistics like network response time (TCP Handshake) and application response time (Time to First Byte) to determine if a perceived bottleneck is actually on your network, or if you need to call the server team.
Use data volume trends to pinpoint traffic anomalies and investigate the
cause.
Monitor "risky" types of traffic.
There are three steps you must complete to start monitoring traffic on your
network:
1. Deploy Packet Analysis Sensors (network and/or server) to Windows nodes
where you want to collect traffic data.
2. In the web console, specify the nodes and applications for which you want
to collect traffic.
Note: Packet Analysis Sensors do not automatically discover nodes and
applications. You must indicate the nodes and applications to monitor
before you will see traffic data in the web console.
3. Allocate appropriate CPU cores and memory for the traffic load for each
sensor.
Traffic data is captured using packet analysis sensors. These sensors collect
packets using either a dedicated Windows SPAN or Mirror port monitor or directly
on your Windows server. Packet Analysis Sensors capture packets from the local
network interface (NIC) and then analyzes collected packets to calculate metrics
for application performance monitoring. These metrics provide information about
application health and allow you to identify possible application performance
issues before they are reported by end-users.
With the ability to analyze packet traffic, QoE provides real observed network
response time (NRT) and application response time (ART). In addition, Packet
Analysis Sensors have the ability to classify and categorize traffic for over 1000
different applications by associated purpose and risk-level.
Requirements
Quality of Experience (QoE) is a component of the Orion Web Console that does
not require any additional hardware beyond what is required by Orion. Before
deploying a packet analysis sensor to any device, review the following system
1036
500 MB
RAM
Network Bandwidth
Other
Requirements
Windows 7, 64-bit or later
Operating System Windows Server 2008, 64-bit or later
Note: 32-bit operating systems are not supported.
Hard Drive Space 500 MB
RAM
1GB, but 2GB is recommended
Network Bandwidth 1GB maximum throughput
SPAN, mirror, or trap port or in-line tap on the monitored
Other
device
Port Requirements
Port
Notes
Required: This port must be open to enable communication with your
17778
Orion server.
This port must be open to deploy packet analysis sensors from your Web
135
Console.
1037
User Scenarios
The following scenario serves as an example of how sensors can monitor
network performance.
1038
Packet Analysis Sensors have a 30-day QoE evaluation license. The QoE
evaluation license must be activated before you can activate the commercial license. There is no need to restart any services after entering commercial license keys.
To apply licenses to an upgraded product, activate the QoE evaluation first,
and then activate your purchased license.
1039
Aggregation level
Sensor Deployment
Managed Node
Configuration
Per site
Per computer
1040
Aggregation level
Sensor Deployment
Managed Node
Configuration
managed nodes
Per site
Per computer
Notes:
l
When deploying network and server sensors, ensure that you do not monitor the same node with multiple sensors. This impacts the QoE metrics.
All monitored nodes must be managed by your Orion Platform product
before they can be added to the sensors.
These deployment scenarios also apply to virtual networks.
1041
Notes:
l
Create a port mirror, SPAN, or network tap on the switch with all the network
traffic to or from the application.
You can monitor multiple applications using the same NPAS.
1042
1043
1044
Notes:
l
l
l
Create a port mirror, SPAN, or network tap on the switch with all the network
traffic to or from the site.
Identify a sample set of users whose computers are monitored by the NPAS
You can monitor multiple applications using the same NPAS.
1045
Note: Identify a sample set of users whose computers are monitored by the SPAS
To Deploy from your Web Console:
1046
1047
Notes:
l
Create a port mirror, SPAN, or network tap on the switch with all the network
traffic to or from the site.
You can monitor multiple applications using the same NPAS.
1048
1049
1050
1051
You must specify which nodes and applications you want the network
sensors to monitor before traffic for these nodes can be collected and data
appear in the QoE dashboard.
Server Sensors automatically monitor pre-selected applicationsincluding
CIFS, FTP, HTTP, MS SQL, RDP, and SNMPon the node they are
installed on. You can change which applications are monitored after the
sensor is deployed.
For each node you choose to monitor, you must also select specific applications.
Packet Analysis Sensors can categorize over 1,000 pre-defined applications,
such as FTP, RDP, CIFS, SQL, and Exchange. You can also define your own
custom HTTP applications.
Note: Because of the hardware requirements needed to process large amounts of
traffic, SolarWinds recommends that you preferentially monitor business-critical
nodes and applications. You can monitor up to 50 applications per node.
Log into the web console using an account with administrative privileges.
Click Settings in the top right of the web console.
In the Settings grouping, click QoE Settings.
Click Manage QoE Applications.
Notes:
l Applications are only listed if there are monitored nodes. You must
first add a Network or Server Sensor before you can enable any applications.
1052
5.
6.
7.
8.
9.
10.
11.
Your newly enabled application will appear on the Manage QoE Applications
page in alphabetical order.
1053
1054
7. Enter the hostname or URL for your filter, then click Next.
8. On the Configure Data Collection page, choose the node(s) you want to
monitor for this type of traffic. Only nodes that have already been specified
as nodes to monitor (on the Manage QoE Nodes page) will appear in this
list.
9. Click Next. Review your choices on the Summary page, then click Finish.
10. Your new application will appear on the Manage QoE Applications page
in alphabetical order.
1055
Guidelines
Not Recommended
3-4
5-6
7+
To change the number of CPU cores and memory allocated to the sensor:
1. Using an account with administrative credentials, log in to your Orion Web
Console.
2. In the top right corner of the web console, click Settings.
3. In the Settings grouping, click Manage QoE Packet Analysis Sensors.
4. Select the sensor to edit.
5. Click Edit Sensor.
6. In the Memory field, select the number of GB you want to allocate to the
sensor.
Note: If you allocate less than the recommended amount of memory, you
may see reduced performance.
7. In the CPU Cores field, select the number of CPU cores you want to allocate to the sensor.
Note: If you allocate fewer than the recommended number of CPU cores,
you may see reduced performance.
8. Click Save.
1056
1057
1058
1059
5.
6.
7.
8.
9.
Log into the web console using an account with administrative privileges.
Click Settings in the top right of the web console.
In the Settings grouping, click QoE Settings.
Click Manage QoE Applications.
Notes:
l Applications are only listed if there are monitored nodes. You must
first add a QoE Network or Server Sensor before you can enable any
applications.
l Applications listed with the Enabled/Disabled toggle "ON" are currently being monitored on at least one node.
l Applications can be disabled (the Enabled/Disabled toggle "OFF")
which means that no traffic for the application is currently collected on
any node.
Select the application you want to edit, and then click Edit.
On the Configure Application view, edit the Productivity Rating as necessary, and then click Next.
On the Configure Data Collection view, choose the node(s) you want to
monitor for this type of traffic.
Note: Only nodes that have already been specified as nodes to monitor on
the Manage QoE Nodes page appear in this list.
Click Next.
Review your choices on the Summary page, then click Finish.
1060
1061
1062
1063
1064
7. Click Next.
1065
1066
7. Click Next.
8. On the Configure Data Collection page, choose the node(s) you want to
monitor for this type of traffic.
Note: Only nodes that have already been specified as nodes to monitor on
the Manage QoE Nodes page will appear in this list.
9. Click Next.
10. Review your choices on the Summary page, and then click Finish.
Applications exceeding the configured Warning Level for response time are
listed with values highlighted in yellow.
Applications exceeding the configured Critical Level for response time are
listed with values highlighted in red.
The chart displays response time for selected applications over time. Graphed
lines match the colors assigned to listed applications.
To customize this resource for viewing in the web console:
1. Click Edit.
2. Edit the chart Title and Subtitle, as appropriate.
3. Select the Number of Items you want to display.
1067
1068
Applications exceeding the configured Warning Level for response time are
listed with values highlighted in yellow.
Applications exceeding the configured Critical Level for response time are
listed with values highlighted in red.
1069
Click Edit.
Edit the chart Title and Subtitle, as appropriate.
Select the Number of Items you want to display.
Select appropriate options from the following drop-down lists to customize
the list of monitored applications:
l Group by
l Category
l Risk Level
l Productivity Rating
5. Select appropriate values for the Default zoom range, Amount of historical data to load, and Sample interval.
6. Click Submit to commit customizations.
To export or print chart data:
1. Click Export.
2. Customize the chart to format it for export, as follows:
a. Edit the chart Title and Subtitle, as appropriate, in the Chart Titles
section.
b. Select appropriate values for the Default zoom range, Time Period,
and Sample Interval.
c. Resize the chart by selecting appropriate Width (pixels) and Height
(pixels).
Note: To maintain the same aspect ratio, enter 0 for the Height and
vary the Width, as needed.
d. Click Refresh to review customizations.
e. Click Submit to commit customizations.
3. Select the appropriate option on the Custom Chart view:
l Click Export to PDF in the top right.
l Click Printable Version in the top right.
l Click Export to XLS in the Display Chart Data section.
l Click Export to HTML in the Display Chart Data section.
Top XX Transactions
This resource lists a specified number of monitored applications by average
number of transactions per minute, from highest to lowest, over a specified period
1070
Traffic By Category
of time. The chart displays the number of transaction for selected applications
over time. Graphed lines match the colors assigned to listed applications.
To customize this resource for viewing in the web console:
1.
2.
3.
4.
Click Edit.
Edit the chart Title and Subtitle, as appropriate.
Select the Number of Items you want to display.
Select appropriate options from the following drop-down lists to customize
the list of monitored applications:
l Group by
l Category
l Risk Level
l Productivity Rating
5. Select appropriate values for the Default zoom range, Amount of historical data to load, and Sample interval.
6. Click Submit to commit customizations.
To export or print chart data:
1. Click Export.
2. Customize the chart to format it for export, as follows:
a. Edit the chart Title and Subtitle, as appropriate, in the Chart Titles
section.
b. Select appropriate values for the Default zoom range, Time Period,
and Sample Interval.
c. Resize the chart by selecting appropriate Width (pixels) and Height
(pixels).
Note: To maintain the same aspect ratio, enter 0 for the Height and
vary the Width, as needed.
d. Click Refresh to review customizations.
e. Click Submit to commit customizations.
3. Select the appropriate option on the Custom Chart view:
l Click Export to PDF in the top right.
l Click Printable Version in the top right.
l Click Export to XLS in the Display Chart Data section.
l Click Export to HTML in the Display Chart Data section.
Traffic By Category
This resource provides a pie chart showing the categories of application traffic
that are currently monitored. Application traffic is characterized in terms of
predefined application categories. Application categories are listed in descending
1071
Log into the web console using an account with administrative privileges.
Click Settings in the top right of the web console.
In the Settings grouping, click QoE Settings.
Click Manage QoE Applications.
Notes:
l Applications are only listed if there are monitored nodes. You must
first add a [[[Undefined variable Core_var.QoE_ProductName_short]]]
Network or Server Sensor before you can enable any applications.
For more information, see "Deploying Packet Analysis Sensors".
l Applications listed with the Enabled/Disabled toggle "ON" are currently being monitored on at least one node.
l Applications can be disabled (the Enabled/Disabled toggle "OFF")
which means that no traffic for the application is currently collected on
any node.
5. Select the application you want to edit, and then click Edit.
6. On the Configure Application view, edit the Productivity Rating as necessary, and then click Next.
7. On the Configure Data Collection view, choose the node(s) you want to
monitor for this type of traffic.
Note: Only nodes that have already been specified as nodes to monitor on
the Manage QoE Nodes page appear in this list.
1072
Log into the web console using an account with administrative privileges.
Click Settings in the top right of the web console.
In the Settings grouping, click QoE Settings.
Click Manage QoE Applications.
Notes:
l Applications are only listed if there are monitored nodes. You must
first add a QoE Network or Server Sensor before you can enable any
applications.
l Applications listed with the Enabled/Disabled toggle "ON" are currently being monitored on at least one node.
l Applications can be disabled (the Enabled/Disabled toggle "OFF")
which means that no traffic for the application is currently collected on
any node.
5. Select the application you want to edit, and then click Edit.
1073
1074
Transactions By Node
Transactions By Node
The Transactions resource displays the total number of transactions monitored on
the viewed node over time.
To customize this resource for viewing in the web console:
1. Click Edit.
2. Edit the chart Title and Subtitle, as appropriate.
3. Select appropriate values for the Default zoom range, Amount of historical data to load, and Sample interval.
4. Click Submit to commit customizations.
To export or print chart data:
1. Click Export.
2. Customize the chart to format it for export, as follows:
a. Edit the chart Title and Subtitle, as appropriate, in the Chart Titles
section.
b. Select appropriate values for the Default zoom range, Time Period,
and Sample Interval.
c. Resize the chart by selecting appropriate Width (pixels) and Height
(pixels).
Note: To maintain the same aspect ratio, enter 0 for the Height and
vary the Width, as needed.
d. Click Refresh to review customizations.
e. Click Submit to commit customizations.
3. Select the appropriate option on the Custom Chart view:
l Click Export to PDF in the top right.
l Click Printable Version in the top right.
l Click Export to XLS in the Display Chart Data section.
l Click Export to HTML in the Display Chart Data section.
1075
Chapter 20:
Monitoring Hardware Health
SAM monitors hardware by polling nodes and utilizing the Hardware Monitoring
Agent software provided by the hardware manufacturer. SAM can monitor
hardware from VMware hosts, HP ProLiant, Dell PowerEdge, and the IBM XSeries using this software, which can be found using the links below:
l
l
l
SAM can also monitor the health of the following Server Blade Chassis without
the need for additional software:
l
l
l
HP C7000
HP C3000
Dell M1000e
HP Insight Management WBEM Providers for Windows Server 2003/2008 is an optional component for
HP System Insight Manager that must be installed for SAM to monitor hardware via WMI. This component
can be found using the following link:
HP Insight Management WBEM Providers for Windows Server 2003/2008
Additionally, you may need to install the HP ProLiant Support Pack for Windows. This link can be found here:
HP Proliant Support Pack
1076
health on Dell servers, use SNMP. Hardware monitoring has been tested on Dell's OpenManage firmware versions
6.2.0, 6.3.0, 6.5.0, 7.0.0, and 7.1.0.
IBM's ServeRAID Manager must be installed on IBM X-Series servers for storage hardware health information to
be displayed in SolarWinds SAM. Installation instructions can be found using the following links:
IBM's ServeRAID ManagerMegaRAID Storage Management Application (Optional: Only needed for MegaRAID
Controller support.)
Hardware monitoring has been tested on IBM's Director Platform Agent 6.3.
Hardware monitoring has been tested on HP's BladeSystem Onboard Administrator 3.10.
Hardware monitoring has been tested on Dell's Chassis Management Controller (CMC) 3.01 and higher.
Fan status
Power Supply status
Temperature
Disk status
Battery status
Array Controller status
Physical Memory status
Chassis Intrusion status
CPU Temperature and/or status
1077
Note: Port 5989 must be opened when polling VMware servers using the CIM
protocol.
If you run a scheduled Network Sonar Discovery of your existing servers, SAM
will automatically collect any servers that support hardware health information the
next time the scheduled discovery runs.
For more information, see:
l
l
2381
Dell
IBM
1311
423
1078
If HP Insight Management WBEM Providers for Windows Server 2003/2008 is installed for HP System
Insight Manager, the Data Source in the SIM web interface will read "WBEM." If this component is not
installed, the Data Source will read "SNMP."
The IBM Director web-based access is an optional component for version 6.x and is not installed by
default.
For information on troubleshooting hardware health polling, see "Troubleshooting Hardware Health" on
page 1588.
1079
Hardware Details
3. In the Node Details group of the Node Details page, click the List
Resources button as shown below:
Here you can select the available hardware you want to monitor by checking the
appropriate boxes and then clicking Submit.
To disable hardware monitoring, navigate back to this screen and uncheck
Hardware Health of Servers, then click Submit.
For information on troubleshooting hardware health polling, see "Troubleshooting
Hardware Health".
Hardware Details
Once you have chosen the hardware you want to monitor, the Hardware Health
Details group appears on the Node Details page and looks similar to the
following illustration, providing general information about your hardware and its
status:
1080
1081
1082
Clicking a server icon in the Overview Chart will bring up a list of the servers with
the indicated status, as shown below. From here, you can navigate to the Details
page of each server by clicking any icon in the list.
1083
1084
1085
Different default thresholds exist for different items in the Hardware Monitoring
Agent Software. Some of these thresholds may be accessible and open to
editing, some may not. Consult your Hardware Monitoring Agent Software user
guide for specific information about editing thresholds.
1086
l
l
l
Sample Interval: This is the interval of time that will be displayed on the
chart.
Title: This will give a title to display for your chart.
Subtitle: This will give a subtitle to display for your chart.
Temperature Display: This allows you to set the temperature units. This
will affect all charts that display temperature for the current user.
Note: For information on changing the measurement units between
Fahrenheit and Celsius, see "Server & Application Monitor Settings".
1087
Time Period for Chart: This allows you to select the span of time the chart
will display.
1088
1089
Chapter 21:
Viewing Performance and Status
The following sections provide a short list and overview of the views and
resources provided with Server & Application Monitor that reveal performance
and status information:
l
l
l
l
l
l
1090
1091
1092
Component Statistics
Provides a number of gauges that pertain to the selected component.
Response time is provided for port components. CPU load, physical
memory, and virtual memory gauges are provided for process and service
components.
Note: SNMP process components do not include the virtual memory
gauge.
Component Details
Provides a number of details about the component, including application
status, component status, component type, component-specific properties,
last up time, next poll time, and any warning or critical thresholds.
1093
1094
1095
1096
1097
1098
Application Availability
Node Details
Availability Statistics
To customize the default SAM application details view:
1. Find an Application Monitor that is using the default view by following
these steps:
a. Click Settings and then click SAM Settings.
b. Click Manage Application Monitors.
c. Find an assigned Application Monitor without a Custom View.
d. Return to Applications > SAM Summary.
2. Click the Application Monitor to view its application details page.
3. Click Customize Page.
4. Proceed with your customizations.
Custom Application Details View
You can select and create a custom application details view. This custom view is
applied at the template level. Applications inherit the custom view setting from
their templates in the same way as other template settings.
To customize an application details view for an assigned Application Monitor:
1. Click Settings and then click SAM Settings.
2. Click Manage Application Monitors.
3. Check the check box next to an Application Monitor and then click Edit
Properties.
1099
1100
To see
Node
Status
IP
Address
Machine
Type
Average
The measured average response time of the selected node as of
Response the last node poll
Time
Packet
Loss
The percent of all transmitted packets that are lost by the selected
node as of the last node poll
CPU
Load
1101
Application Tooltips
Memory
Used
# of
Running
VMS
ESX Host
Status
Application Tooltips
Hover over
To see
App Name
App Status
Server Status
Components with
Problems
1102
1103
1104
1105
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.
1106
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
Note: The Export button will allow you to export this data to both MS Excel and
HTML.
1107
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
1108
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
1109
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
1110
Volume Size
This resource shows the size of the current volume being monitored and is
located on the Volume Details page.
This chart is interactive. Hovering over any part of the chart will provide detailed
information. You can check or uncheck any box in the legend to add or remove
that element from the chart, as shown below:
Zooming
1111
5. Make your selections, then click Submit, on both the Orion General
Thresholds screen and the Edit Properties screen.
1112
1113
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons in the head of the Zoom column. Alternatively,
you can have the chart show a specific date range by dragging the mouse over an
area of the chart or manipulating the sliders of the lower chart.
Memory Capacity Forecast Chart
This resource graphically details the memory peak trend and average trend
history of the memory. Hovering over any time period within the chart will display
detailed information about that time period in the tooltip.
The colors of the main chart correspond to the table in the legend, which provide
details about trend slopes and thresholds.
1114
1115
1116
Paging controls are located at the bottom of the resource, allowing you to
navigate through all data available for this resource. Respectively, the controls
are: Fist Page, Previous Page, Page Number, Next Page, and Last Page. You
can also specify the number of items to show on the resource or Show All.
Top XX Capacity Problems
This resource displays the top nodes with capacity problems. Clicking a node in
the list will take you to the Node Details page for that node. Clicking an objec tin
the list will take you to the Details page for that object. When an object's capacity
breaches the Warning threshold, the background of the warning value will
become yellow. When an object's capacity breaches the Critical threshold, the
background of the critical value will become red.
1117
l
l
Node:Lists the node that is being monitored with its colored icon indicating
its current status.
Detail: Lists the object with the capacity problem.
Warning: Displays the time remaining for the Warning threshold to be
breached.
Critical: Displays the time remaining for the Critical threshold to be
breached.
At Capacity: Displays the time remaining for the listed object to be at capacity.
1118
Percent Utilization
These gauges provide a visual representation showing the percentage of utilized
bandwidth when transmitting and receiving data. The Thresholds button allows
you to configure these thresholds to suit your needs.
1119
1120
1121
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
1122
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
1123
Zooming
1124
1125
Zooming
You can have the chart show a predetermined time period of data by clicking on
any one of the three Zoom buttons; 1 hour, 12 hours, or 24 hours. Alternatively,
you can have the chart show a specific time range by dragging the mouse over a
small area of the chart, or by adjusting the sliders, also highlighted.
Once you have a time period selected, the lower chart will zoom to the starting
and ending values of the selected time period. With the lower chart you can zoom
in further by fine tuning the view with the sliders, highlighted above. The main
view of the chart will display the selected time period between the two sliders of
the lower chart.
1126
1127
Chapter 22:
Creating Account Limitations
The Account Limitation Builder application allows you to create and customize
account limitations for the SolarWinds Web Console. These limitations ensure
that users of the web console can only view the network objects that are pertinent
to their job duties. The following are but a few examples of the uses of account
limitation in the SolarWinds Web Console:
l
l
l
l
1128
1129
Chapter 23:
Managing Processes, Services,
Tasks, and Events in Real Time
l
l
l
To manage and monitor real time processes, see "Real Time Process
Explorer"
To manage and monitor real time services, see "Service Control Manager"
To manage and monitor scheduled tasks, sWindows Scheduled Task Monitor
To view and monitor real time events, see "Real Time Event Viewer"
1130
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
Notes:
l
l
l
Only SAM administrators can end processes as well as enable and disable
the RTPE.
The User Name and Command Line columns are hidden by default.
Using the RTPE on a node monitored via ICMP, which has no working component, will require you to select Windows credentials manually. Consider
promoting the selected node to SNMP or WMI to avoid this prompt. For
more information, see:
l Promoting a Node from ICMP to SNMP Monitoring
l Promoting a Node to WMI Monitoring
1131
1132
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
To navigate to the Component Details page:
1. Click the Home tab in the SAM web console.
2. In the All Applications group, click an Application.
3. Click a component.
WMI
SNMP
Name
Yes
Yes
Process ID
Yes
Yes
Yes
CPU usage
Yes
Yes
1133
Physical Memory
Yes
Yes
Virtual Memory
Yes
No
Disk I/O
Yes
No
User Name
Yes
No
Command Line
Yes
Yes
Polling interval
Five seconds
Up to two minutes
Notes:
l
Windows servers do not update their SNMP statistics more frequently than
every two minutes. It takes at least two updates to these statistics to provide
an accurate calculation. This means data displayed in the RTPE via SNMP
can take up to four minutes to display. If this is unacceptable, consider changing the protocol to WMI.
SNMP uses significantly less bandwidth than WMI.
____________________________________
Information on certain processes may not be exposed which can result in certain rows being blank.
Each column can be sorted by clicking the column head or hovering over the
column name and clicking the drop down arrow. Columns can also be added or
removed this way. Each column can also be resized and/or re-arranged by
dragging the separators between each column head to change the width, or the
column heads themselves to change their position.
Note: By default, all available columns, with the exception of the User Name and
Command Line, are shown for the top ten running processes.
1134
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
1135
To start polling:
To start polling:
1. Click Start Polling at the top-left of the window.
For Windows based nodes, you can change the credentials used by clicking the
Use Different Credentials button to bring up the credential library dialog box.
Clicking Refresh
High CPU Percent Utilization with Top 10 Processes. (This alert will
send an email when the CPU utilization is greater than 80%.)
High Physical Memory Utilization with Top 10 Processes. (An alert will
be sent when physical memory usage is at or above 90%.)
High Virtual Memory Utilization with Top 10 Processes. (An alert will be
sent when virtual memory usage is at or above 90%.)
These alerts can be found in the Alert Wizard. For more information, see Adding
Alerts.
Note: Alerts may lag if you are monitoring hardware via SNMP. It takes at least
two updates to these statistics to provide an accurate calculation, meaning an
alert can take up to four minutes to reach its recipient. If this is unacceptable,
consider changing the protocol to WMI, which updates every five seconds. Also
consider adjusting the trigger time to a value greater than two minutes. For more
information, see "Using the Real Time Process Explorer".
1136
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
Following is the path where the executable
SolarWinds.APM.RealTimeProcessPoller.exe is located along with its
command line arguments:
C:\Program Files (x86)
\SolarWinds\Orion\APM\SolarWinds.APM.RealTimeProcessPoller.exe
Definition
Definition
-n
-count
-sort
Processor time.
This is the
default value if
the command
line argument
is not specified.
PhysicalMemory
VirtualMemory
Process virtual
1137
memory.
DiskIO
Process disk
I/O per second.
-timeout
-alert
Defines AlertDefID of
associated triggered
alert. If this argument is
provided, then alert
notes are updated with
the results from polling.
-activeObject
Example 1:
This example will return the top 20 processes with the highest virtual memory
consumption running on the host with node ID 123.
SolarWinds.APM.RealTimeProcessPoller.exe -n=123 -count=20 sort=VirtualMemory -timeout=300
Example 2:
This example uses the Execute an External Program alert action:
SolarWinds.APM.RealTimeProcessPoller.exe
t=${AlertDefID}
-n=${NodeID} -aler-
Example 3:
This example uses the Execute an External Program alert action for an alert
defined for the Volume object type:
SolarWinds.APM.RealTimeProcessPoller.exe -n=${NodeID} alert=${AlertDefID} -activeObject=${NetObjectID} -sort=VirtualMemory
1138
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
1139
1140
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
To navigate to the Node Details page:
1. Click the Home tab in the SAM web console.
2. In the All Nodes group, click a node.
Note: The Service Control Manager button will not be available on the Node
Details page in situations where Top 10 lists are hidden. Clicking Service Control
Manager will open the SCM in a new window and the services will be sorted
alphabetically.
Note: Pop-ups must be enabled in your browser to view the Service Control
Manager.
Management Resource
On the Node Details page, the Service Control Manager button can be found in
the Management resource, as highlighted below:
1141
Description
Default
Setting
Service Job
Life Time
3
minutes
Service Poll
Interval
25
seconds
Service Action
Job Timeout
3
minutes
1142
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
The WSTM comes with an alert which will notify you of any task execution
failures, as well as web based reports that allow you to view all scheduled tasks
configured across all servers in your environment. Additionally, there is a
dedicated Task Failure Report you can view or have emailed to you on a regular
basis.
Note: This resource is hidden when the WSTM is not being monitored on a node.
For more information, refer to the following sections:
l
l
l
l
l
1143
l
l
When SAM is installed on Windows 2003 R2 SP2, scheduled tasks on Windows 2008 or later cannot be polled by the Windows Scheduled Task Monitor (WSTM).
The WSTM consumes five license units per node.
Only tasks from root directory can be monitored. The WSTM will not work for
tasks from every level of the Task Scheduler Library.
Notes:
l
The Windows Scheduled Tasks option is hidden when a task is not found
on the target machine.
The Windows Scheduled Tasks option is unchecked by default when at
least one task is found on the target machine.
The Windows Schedule Tasks option is checked when tasks are already
being monitored.
1144
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
1. From the web console, navigate to Settings > Manage Nodes.
2. Click [+] Add Node.
3. Select the Windows Servers: WMI and ICMP option and enter the proper
credentials.
4. Click Next.
5. Check Windows Scheduled Tasks.
To enable the WSTM via listing the resources of a WMI managed node:
1. From the web console's Home tab, find the All Nodes resource.
2. Expand the Windows tree by clicking Windows.
3. Click a Windows node to be taken to the Node Details page for that node.
1145
1146
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
1.
2.
3.
4.
From the web console's Home tab, find the All Nodes resource.
Expand the Windows tree by clicking Windows.
Click a Windows node to be taken to the Node Details page for that node.
On the Node Details page, find the Windows Scheduled Task resource, as
shown:
The WSTM has four columns that provide the following information:
l
l
l
l
Task Name: This column displays the detailed name of the scheduled task.
Status: This displays the current status of the listed task. For more information, see WTSM Status
Last Run Time: This displays the last time the listed task executed.
Last Run Result: This displays the result of the listed task's last execution
as an icon.
Tips:
1147
l
l
Hovering over any item in the Task Name column will provide a tooltip with
detailed information about the listed task.
You can sort the display by clicking the head of each column.
Clicking >>Edit Settings at the bottom of the resource will allow you to:
l Change the polling frequency.
l Change the polling timeout period.
l Change credentials.
l Add custom notes.
To View Alerts:
1. From the web console, navigate to Home >Alerts >Manage Alerts.
2. Select the alerts you want to view from the list, or type a keyword in the text
box and click the Search button:
1148
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
Description
(0x0)
(0x1)
(0x2)
(0xA)
(0x41300)
(0x41301)
(0x41302)
The task will not run at the scheduled times because it has
been disabled.
(0x41303)
(0x41304)
(0x41305)
One or more of the properties that are needed to run this task on
a schedule have not been set.
1149
(0x41307)
(0x41308)
(0x4131B)
The task is registered, but not all specified triggers will start the
task.
(0x4131C)
The task is registered, but may fail to start. Batch logon privilege
needs to be enabled for the task principal.
(0x41325)
(0x8004020D) Cannot modify or delete an object that was not added using the
COM+ Admin SDK.
(0x80041309) A task's trigger is not found.
(0x8004130A) One or more of the properties required to run this task have not
been set.
(0x8004130B) There is no running instance of the task.
(0x8004130C) The Task Scheduler service is not installed on this computer.
(0x8004130D) The task object could not be opened.
(0x8004130E) The object is either an invalid task object or is not a task object.
(0x8004130F) No account information could be found in the Task Scheduler
security database for the task indicated.
(0x80041310) Unable to establish existence of the account specified.
(0x80041311) Corruption was detected in the Task Scheduler security
database; the database has been reset.
(0x80041312) Task Scheduler security services are available only on
Windows NT.
(0x80041313) The task object version is either unsupported or invalid.
(0x80041314) The task has been configured with an unsupported combination
of account settings and run time options.
1150
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
1151
WTSM Status
(0xC000013A) The application terminated.
(0xC06D007E) Unknown software exception.
For a complete list of error codes, see http://msdn.microsoft.com/enus/library/windows/desktop/aa383604%28v=vs.85%29.aspx
WTSM Status
The following table lists the conditions that must be met in order for a status of
Available, Not Available, or Undefined, to be triggered:
Available
Not Available
Undefined
Task Success
Default
Task Ready
Task Running
Task Disabled
Invalid Task
Task Terminated
No Security Services
Task Queued
1152
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
Malformed Xml
Too Many Nodes
Past End Boundary
Already Running
User Not Logged On
Invalid Task Hash
Service Not Available
Service Too Busy
Task Attempted
Task Not V1 Compatible
Start On Demand
Service Does not Exist
No File Specified
Cannot Delete Object
Not Valid Application
Incorrect Function
File Not Found
Environment Is Incorrect
Application Terminated
Unknown Software Exception
Operation Canceled
1153
1154
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
To navigate to the Component Details page:
1. Click the Home tab in the SAM web console.
2. In the All Applications group, click an application.
3. Click the Windows Event Log component (if available).
Filtering Events
Different events are displayed in the RTEV depending upon the log type and
filters you choose.
Once you select a Log Type from the drop down list, SAM will immediately begin
collecting these logs and display them in the message window to the right, as
shown:
1155
3. Select the type of messages you want the filter to keep by checking the
appropriate Event Level check boxes. (Note that the icons in this legend
correspond to messages in the display window.)
1156
Chapter 23: Managing Processes, Services, Tasks, and Events in Real Time
Reading Events
Once filtering is complete, you can hide and unhide the filtering pane on the left
by clicking either of the two arrows, highlighted in red:
The display window shows a list of the most recent events. Should any new
events occur while this window is open, a green bar at the top of the window will
indicate that new events have arrived, as shown in the above image. You can
click the green bar to add these new events to the display window.
Note: The Level column icons correspond to the Event Level icons in the legend
of the events pane.
Clicking on any message in the display window will bring up a message box
providing the entire message along with additional details, as shown:
Monitoring Events
There are three ways to begin monitoring events from within the RTEV:
l
l
All three methods (highlighted below) will take you to the Add Component Monitor
wizard and allow you to create an application based on your selection.
1157
This drop down menu will help you better filter the results you want.
1158
Chapter 24:
Monitoring Syslog Messages
Syslog messages are one type of real time notification that network devices can
send in response to designated network events. SolarWinds SAM provides the
SolarWinds Syslog Service, allowing SolarWinds to receive Syslog messages
from any monitored network device. The SolarWinds Syslog Service also has the
ability to open multiple connections to your SQL server, so it can handle large
numbers of simultaneously incoming Syslog messages from all your monitored
devices.
SolarWinds SAM uses the SolarWinds Syslog Service to listen on UDP port 514
for incoming Syslog messages. Received messages are then decoded and
stored in the Orion database. Until they are acknowledged, Syslog messages are
available for viewing either in the web console Syslog view or in the Syslog
Viewer application. The Syslog view in the SolarWinds Web Console provides
quick access to current messages, filtered by any or all of the following criteria:
l
l
l
The Syslog Viewer application also allows you to tailor your view of Syslog
messages using fully customizable rules. Additionally, the Syslog Viewer gives
you the ability both to search your Orion database and to configure
Syslog-specific alerts for received Syslog messages.
Note: When configuring your network devices to send Syslog messages, confirm
that messages are sent to the IP address assigned to your SolarWinds SAM
server. To ensure the proper configuration of a network device for Syslog
messaging, refer to the documentation supplied by the device vendor.
1159
Syslog Resources
SolarWinds SAM provides the following Syslog-related resources for inclusion
within web console views.
Advanced Syslog Counts
Every Syslog message has a designated severity. For more information
about Syslog severities, see Syslog Severities on page1173. The
Advanced Syslog Counts resource groups by severity all Syslog messages
received by the currently viewed node. For each severity, this resource
provides the number of received Syslog messages.
Advanced Syslog Parser
The Advanced Syslog Parser resource provides a comprehensive view of
the Syslog messages most recently received by the viewed node. The most
recent messages of each severity are listed. For more information about
Syslog severities, see Syslog Severities on page1173.
1160
1161
4.
5.
6.
7.
8.
9.
10.
11.
12.
Note: Only objects that have sent a Syslog message to the SolarWinds
server will be listed in this field.
If you want to filter your Syslog messages table by device type, select
the type to which you want to limit your view in the Type of Device field.
If you want to filter your Syslog messages table by severity, select the
severity level to which you want to limit your view in the Select Severity
field.
Note: For more information, see Syslog Severities on page1173.
If you want to filter your Syslog messages table by facility, select the
facility to which you want to limit your view in the Select Facility field.
Note: For more information, see Syslog Facilities on page1172.
If you want to limit your Syslog messages table to show only messages of a designated type, type the appropriate string in the Message
Type field.
If you want to limit your Syslog messages table to show only messages containing a designated pattern, provide the appropriate string in
the Message Pattern field.
Note: An asterisk (*) is required as a wildcard character, both before and
after the pattern string, unless the provided pattern is any of the following:
l The beginning of the message
l The end of the message
l The full message
If you only want to see Syslog messages from a specific period of
time, select a time period from the Time Period menu.
Confirm the number of messages displayed in the Show Messages field.
If you want cleared or acknowledged messages to remain in the Syslog view, check Show Cleared Messages.
Click Refresh to update the Syslog messages list with your new settings.
1162
1163
1164
1165
1166
1167
1168
Description
1169
abbreviation.
${AMPM}
${D}
${DD}
${Date}
${DateTime}
${DayOfWeek}
${DayOfYear}
${H}
Current hour
${HH}
${Hour}
${LocalDOW}
${LongDate}
${M}
${MM}
${MMM}
${MediumDate}
${Minute}
1170
${Month}
${N}
${S}
Current second.
${Second}
${Time}
${Year2}
${Year}
Description
Copyright information
${DNS}
${Hostname}
${IP_Address}
${Message}
${Version}
1171
Syslog Facilities
The facility value indicates which machine process created the message. The
Syslog protocol was originally written on BSD Unix, so Facilities reflect the
names of UNIX processes and daemons, as shown in the following table.
Note: If you are receiving messages from a UNIX system, consider using the
User Facility as your first choice. Local0 through Local7 are not used by UNIX
and are traditionally used by networking equipment. Cisco routers, for example,
use Local6 or Local7.
Number Source
Number Source
kernel messages
12
NTP subsystem
user-level messages
13
log audit
mail system
14
log alert
system daemons
15
clock daemon
security/authorization messages
16
local use 0
(local0)
17
local use 1
(local1)
18
local use 2
(local2)
19
local use 2
(local3)
UUCP subsystem
20
local use 2
(local4)
clock daemon
21
local use 2
(local5)
10
security/authorization messages
22
local use 2
(local6)
11
FTP daemon
23
local use 2
1172
Syslog Severities
(local7)
Syslog Severities
The following table provides a list of Syslog severity levels with descriptions and
suggested actions for each.
Number Severity
Suggested Actions
Emergency
Alert
Critical
Error
Warning
Notice
1173
Debug
1174
Chapter 25:
Monitoring SNMP Traps
SNMP traps signal the occurrence of significant events by sending unsolicited
SNMP messages to a monitoring device. The SolarWinds Trap Server listens for
incoming trap messages on UDP port 162 and then decodes, displays, and stores
the messages in the SolarWinds SAM database. The SolarWinds Trap Service
allows SolarWinds SAM to receive and process SNMP traps from any type of
monitored network device, and, because the SolarWinds Trap Service is multithreaded, it can handle large numbers of simultaneously incoming traps.
You can view SNMP traps in the Trap Viewer application. The Trap Viewer
application allows you to configure trap-specific alerts, to view and search traps,
and to apply powerful trap filtering.
Note: When configuring devices to send SNMP traps, confirm that traps are sent
to the IP address assigned to the SolarWinds SAM server. To ensure proper
configuration, refer to the documentation supplied by the vendor of your devices.
1175
1176
1177
1178
6.
7.
8.
9.
1179
1180
Description
${AbbreviatedDOW}
${D}
${DD}
${Date}
${DateTime}
${Day}
${DayOfWeek}
${DayOfYear}
${H}, ${Hour}
1181
${HH}
${LocalDOW}
${LongDate}
${LongTime}
${M}
${MM}
${MMM}
${MMMM}
${MediumDate}
${MediumTime}
${Minute}
${MonthName}
${S}
${Second}
${Time}
${Year}
${Year2}
Description
1182
${Copyright}
Copyright information
${DNS}
${Hostname}
${IP}
${IP_Address}
${Message}
${RawValue}
${vbData1}
${vbName1}
1183
Chapter 26:
Managing the SolarWinds SAM Database
All SolarWinds network monitoring and management products use a Microsoft
SQL Server database to store web console settings and collected network
performance and configuration data. The following database utilities are
packaged with SolarWinds products to help you manage your Orion database.
Database Manager
Allows you to perform queries, edit database values, export data, and
perform database repair and compaction on your Orion database. For more
information, see Using Database Manager.
Database Maintenance
Allows you to summarize, clean, and compact your Orion database. For
more information, see Database Maintenance.
The database SolarWinds uses is hosted on a Microsoft SQL Server. When
installing SQL Server, you have the option of installing the SQL Server
Management Studio. If you are the database administrator for the SQL Server
hosting your Orion database, SolarWinds generally recommends that you install
this utility as it provides a number of features that are not currently available in the
Orion database Manager. For more information, see Using SQL Server
Management Studio.
Note: SolarWinds Network Configuration Manager maintains its own additional
database for device configurations and user activity logging.
1184
Adding a Server
If you have not already designated a database for use with SolarWinds as a
backup or supplement, use the following steps to add a SQL server to the
Database Manager. Once added, your selected server and associated databases
display in the tree structure in the left pane of Database Manager.
To add a SQL server to Database Manager:
1. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
2. Click File> Add Server.
3. Select from the SQL Server list or enter the IP address of the SQL server.
4. Select the login style.
Note: You may choose to Log in using Windows NT Integrated Security
to automatically pass the Windows user ID and password to the SQL server,
or select Log in using an SQL Server userid and password to use a separate login. Upon selecting the latter option, the window changes to provide
fields to enter the separate SQL Server User Name and Password that you
want to use.
5. Click Connect to Database Server.
Restoring a Database
The following steps restore a database that you have backed up.
To restore a database from backup:
1. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
2. If the SQL Server hosting your Orion database is not listed in the left
pane, you must add the SQL Server hosting your Orion database. For more
information, see Adding a Server.
3. Click [+] in the left pane to expand the SQL Server hosting your Orion database, and then click your Orion database.
1185
1186
5. If the Last Backup field on the Properties tab is blank, you have not
generated a backup of the selected database. For more information about
scheduling a recommended regular database backup, see Creating a Database Maintenance Plan.
1187
1188
Detaching a Database
Detaching a database removes its reference from the SQL Server, allowing you to
safely move files to different locations. Database Manager allows you to detach a
database and leave the data files of a database intact, as shown in the following
procedure.
Note: SolarWinds does not recommend using the Detach Database option to
migrate a database from one SQL Server to another. For more information, see
Migrating your Database.
To detach a database:
1. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
2. If the SQL Server hosting your Orion database is not listed in the left
pane, you must add the SQL Server hosting your Orion database. For more
information, see Adding a Server.
3. Click [+] in the left pane to expand the SQL Server hosting your Orion database, and then click your Orion database.
1189
1190
1191
Database Maintenance
Database Maintenance
The primary tasks that are available for maintaining a SQL database are data
summarization and database compaction. Data summarization occurs
automatically as a part of the nightly maintenance program. You can also run
database maintenance on demand from the Windows Start menu.
1192
If you have more than one Polling Engine, you will need to
stop each additional Polling Engine before continuing.
Do not stop the SQL Service. The SQL Service needs to be
running in order to make the necessary changes to the database.
1193
To migrate SAM:
To migrate SAM:
1. Log on to the computer that hosts your current SAM server.
2. Click Start > All Programs> SolarWinds Orion> Database Utilities>
Database Manager.
3. If your SQL Server is not listed in the left pane, add your server, as
shown in the following steps:
a. Click Add Server.
b. Select the name of the SQL instance from the SQL Server list. If your
server is not listed, type the name or IP address.
c. Select the appropriate authentication type, and then click Connect to
Database Server.
4. Locate and right-click your database in the Database Manager tree in the
left pane, and then click Backup Database.
5. Type a Description of the database backup, and then specify a Backup
Filename, including the path.
Note: Click the ellipsis to directly select the Backup Filename.
6. Select either of the following options:
l If you want to attach your new database backup to the end of the
selected backup file, select Append to the end of the Backup
File.
l If you want to overwrite the selected backup file, select Overwrite
Backup File.
7. Click OK.
8. If you are moving the SQL database to the new SAM server, copy the
new backup file (typically named NetPerfMon.BAK) to a folder on the new
server.
9. Install SAM on the new server, but do not run the Configuration Wizard yet.
Reboot the server if prompted, and then register the software.
Note: A new license key is required, and you will need to install
SolarWinds License Manager to manage the required license migration.
10. On the new server, click Start> SolarWinds Orion> Database Utilities>
Database Manager.
11. If your SQL Server is not listed in the left pane, add your server, as
shown in the following steps:
a. Click Add Server.
b. Select the name of the SQL instance from the SQL Server list. If your
server is not listed, type the name or IP address.
c. Select the appropriate authentication type, and then click Connect to
Database Server.
1194
1195
To restore your database backup file on a server running SQL Server 2008:
7. Right-click the name of your SAM database (for example, right-click NetPerfMon), and then click Tasks > Back Up.
8. In the Source area, select Full as the Backup type.
9. In the Backup set area, provide an appropriate Name and Description for
your database backup.
10. If there is not already an appropriate backup location listed in the Destination area, click Add, and then specify and remember the destination path
and file name you provide. This is the location where your backup is
stored.
Note: Remember, if your database is on a remote server, as recommended, this backup file is also created on the remote database server. It
is not created locally.
11. Click Options in the Select a page pane on the left.
12. In the Reliability area, check Verify backup when finished.
13. Click OK.
14. Copy the .bak file from your current SAM database server to your new database server.
Restoring the Backup File on Your New Database Server
The following procedures walk you through the restoration of your SAM database
backup file on your new database server.
Restoring a Database Backup File for SQL Server 2008
Complete the following procedure if you are restoring your SAM database backup
file to a database server running SQL Server 2008.
To restore your database backup file on a server running SQL Server 2008:
1. Log on to the new database server using an administrator account.
2. Click Start > All Programs > Microsoft SQL Server 2008 > SQL Server
Management Studio.
3. Click File > Connect Object Explorer.
4. Specify the name of the new SAM Database server on the Connect to
Server window.
5. If you are using SQL Server Authentication, click SQL Server Authentication in the Authentication field, and then specify your credentials in the
User name and Password fields.
6. Click Connect.
7. Click the name of your server to view an expanded list of objects associated with your server, and then right-click Databases.
8. Click Restore Database.
1196
16.
17.
18.
19.
a.
b.
c.
20.
21.
1197
1198
1199
To export data from one Orion database and import it into another:
6. Copy the newly created backup file to a folder on the new server.
Note: The backup file is named after your Orion database and given a
.bak extension. For example, if you have designated OrionDB as the
name of your Orion database, the backup is named OrionDB.bak.
7. Click Start> All Programs> SolarWinds> Advanced Features> Database Manager.
8. Click Add Server.
9. Select the name of the SQL instance from the SQL Server list. If your
server is not listed, complete the procedure in Adding a Server on
page1185.
10. Select the appropriate authentication type, and then click Connect to Database Server.
11. Select your new server in the list, and then click Server> Connect to
Server.
12. Click Server> Restore Database.
13. Enter the path to the database backup file on the server or click Browse
() and then navigate to the location of the database backup file.
14. Click OK.
15. Close the Database Manager.
16. Click Start> All Programs> SolarWinds> Configuration and AutoDiscovery> Configuration Wizard.
17. Specify the newly restored database in the Database Setup section of the
wizard.
18. When prompted, click Yes to use the existing database.
1200
Chapter 27:
Creating Custom Properties
SolarWinds SAM allows you to create custom properties using the Manage
Custom Properties Editor. This allows you to add a custom property to any
monitored device. Custom properties are additional fields, such as country,
building, asset tag, or serial number, that you can define and store in your Orion
database. After properties are added, they are available for display and filtering
both within the SolarWinds Web Console and within the Report Writer
application. A few more examples of how custom properties may be used are as
follows:
l
l
l
l
l
The Manage Custom Properties Editor lets you choose from a provided collection
of the most commonly used properties, or you can easily and efficiently build your
own custom properties. For more information, see Creating a Custom Property.
Once your custom property is defined, the Import Wizard allows you to populate
your new property from either a text- or comma-delimited file. For more
information, see Importing and Exporting Custom Property Data.
Alternatively, if you only have a few individual changes or additions, you may
choose to make those changes using the Edit view. For more information, see
Editing Custom Properties.
1201
5. Click Next.
6. On the following screen, click Select Nodes to bring up the following
screen, which allows you to select the nodes you want by moving them to
the right-hand column and clicking Add, in green:
1202
7. Click Submit.
8. Once your nodes are successfully added, the following message appears
with a link:
9. Clicking Show Assignments will take you to the Manage Nodes page, as
shown below:
1203
1204
3. Next, select the columns and properties that you would like to have exported.
4. Finally, choose the file type your exported data should be saved as from the
drop down menu, and then click Export.
1205
1206
1207
Chapter 28:
Additional Polling Engine and Web
Console
Installing additional pollers and Web Consoles help you extend your SolarWinds
Server & Application Monitor (SAM) implementation. You can install additional
polling engines to aid you in load balancing and configure additional websites to
ensure redundant access through more than one web server. By sharing the
same database, you can also share a unified user interface, making the addition
of polling engines transparent to your staff.
The following sections provide descriptions and installation procedures for
adding polling engines and websites. These components are licensed and
purchased separately from your main SolarWinds Server & Application Monitor
install and require the installation of the SolarWinds SAM Additional Polling
Engine. For more information about purchasing licenses, contact your sales
representative (sales@solarwinds.com) or customer service.
Refer to the following sections for more information:
l
l
l
l
1208
1209
Nodes are assigned to particular polling engines by selecting the desired Polling
Engine when adding a node using the Add Node wizard.
An additional method for assigning nodes to polling engines is to use the Poller
Load Balancing option in the Monitor Polling Engines tool. For more information,
see To assign nodes to polling engines:
1210
1211
1212
1213
1214
1215
Description
${Caption}
${InterfaceID}
${InterfaceType}
${MAC}
${MTU}
${InterfaceSpeed}
1216
Interface Traffic
Interface Variable
Description
network node
${InterfaceName}
${InterfaceIcon}
${NodeID}
${Counter64}
Interface Traffic
The following are valid interface traffic-related variables.
Interface Traffic
Variable
Description
${OutBandwidth}
${OutBps}
${InBps}
${OutPps}
1217
Interface Traffic
Variable
Description
${InPps}
${InPktSize}
${OutUcastPps}
${OutMCastPps}
${InUcastPps}
${InMcastPps}
${OutPktSize}
${InPercentUtil}
${MaxOutBpsTime}
${InBandwidth}
1218
Interface Errors
Interface Errors
The following are valid interface error-related variables.
Interface Error Variable
Description
${InDiscardsToday}
${InErrorsToday}
${OutErrorsToday}
${OutDiscardsToday}
${InDiscardsThisHour}
${InErrorsThisHour}
${OutErrorsThisHour}
1219
Chapter 30:
SolarWinds Variables and Examples
SolarWinds SAM product components, including the Alert Manager, both the
Traps Viewer and the Syslog Viewer, and Network Atlas can employ SolarWinds
variables. These variables are dynamic and, in the case of alerts, parse when the
alert is triggered or reset. For example, the variable ${ResponseTime} will parse
with the current response time of the node that is triggering the alert.
Note: In some cases, the database table name may be required for alert
variables, as in ${Nodes.CPULoad}. If a variable does not respond as intended,
include the relevant table name for the desired variable.
Variable Modifiers
The variables in the following sections can be modified by appending any of the
variable modifiers in the following table:
Variable Modifier
Description
-Raw
-Previous
-Cooked
1220
1221
Description
Example
Any character
except
[,\,^,$,.,|,?,*,+,
(,),
a matches a
\ (backslash)
followed by
any of
[,\,^,$,.,|,?,*,+,
(,),
\+ matches +
\xFF where FF
are 2
hexadecimal
digits
\xA9 matches
when using the
Latin-1 code
page.
\n, \r and \t
\r\n matches a
DOS/Windows
CRLF line
break.
Description
Example
1222
Classes or
Sets
[(opening
square
bracket)
Any
character
except ^,-,],\
add that
character to
the possible
matches for
the character
class.
[abc]
matches a,
b or c
\ (backslash)
followed by
any of ^,-,],\
[\^\]]
matches ^
or ]
- (hyphen)
except
immediately
after the
opening [
[a-zA-Z0-9]
matches
any letter
or digit
^ (caret)
immediately
after the
opening [
[^a-d]
matches x
(any
character
except a, b,
c or d)
1223
Anchors
\d, \w and \s
[\d\s]
matches a
character
that is a
digit or
whitespace
Anchors
Anchors Description
Example
^ (caret)
^.
matches
a in
abc\ndef.
Also
matches
d in
"multiline"
mode.
$(dollar)
.$
matches
f in
abc\ndef.
Also
matches
c in
"multiline"
mode.
\A
\Z
1224
.\Z
matches
\z
f in
abc\ndef
.\z
matches
f in
abc\ndef
Quantifiers
Quantifiers Description
Example
? (question
mark)
abc?
matches
ab or abc
??
abc??
matches
ab or abc
* (star)
.*
matches
"def"
"ghi" in
abc "def"
"ghi" jkl
*? (lazy
star)
.*?
matches
"def" in
abc "def"
"ghi" jkl
#NAME?
.+
matches
"def"
"ghi" in
1225
Quantifiers
abc "def"
"ghi" jkl
+? (lazy
plus)
.+?
matches
"def" in
abc "def"
"ghi" jkl
{n} where n
is an
integer >=
1
a{3}
matches
aaa
{n,m}
where n >=
1 and m >=
n
a{2,4}
matches
aa, aaa
or aaaa
{n,m}?
where n >=
1 and m >=
n
a{2,4}?
matches
aaaa,
aaa or
aa
{n,} where
n >= 1
a{2,}
matches
aaaaa in
aaaaa
{n,}? where
n >= 1
a{2,}?
matches
aa in
aaaaa
1226
Example
Word Boundaries
Word Boundary
Description
Example
\b
\B
Alternation
Alternation Character
Description
Example
abc|def|xyz
matches
abc, def or
xyz
1227
abc
(def|xyz)
matches
abcdef or
abcxyz
Finds the first line service tcp-keepalives-in and then looks for service
tcp-keepalives-out on any line after that. The regular expression string .*\n
(.*\n)*.* is used to search any number of lines between strings. access-list
105 deny.*tcp any any eq 139 log
Finds the line with access-list 105 deny, followed by any number of
characters of any type, followed by tcp any any eq 139 log on the same
line. The regular expression string .* finds any character and any number of
characters on the same line. This expression can be used to find spaces,
tabs, numbers, letters, or special characters. ntp clock-period \d*
Finds any line that includes ntp clock-period, followed by any number. The
regular expression string \d* will find any number at any length, such as 3,
48, or 2394887.
user \x2a
1228
Finds any line that includes user *. The regular expression string \x,
followed by a hexadecimal value, specifies an individual character. In this
example, \x2a represents the asterisk character, which has a hexadecimal
value of 2a.
General
The following are valid, general alert variables:
General Variable
Description
${Acknowledged}
Acknowledged status
${AcknowledgedBy}
${AcknowledgedTime}
${Application}
${CR}
${Copyright}
Copyright information
${ObjectName}
${Release}
Release information
${Version}
1229
Date/Time
Date/Time
The following are valid date and time variables:
Date/Time Variable
Description
${AMPM}
AM/PM indicator
${AbreviatedDOW}
${D}
${DD}
${Date}
${DateTime}
${DayOfWeek}
${DayOfYear}
${H}
Current hour
${HH}
${Last2Hours}
${Last24Hours}
Last 24 hours
${Last7Days}
${LastHour}
Last hour
${LocalDOW}
${M}
1230
${MM}
${MMM}
${MMMM}
${MediumDate}
${Minute}
${S}
Current second.
${Second}
${Time}
${Today}
${Year}
${Year2}
${Yesterday}
Group Variables
The following are valid group variables:
Group Variable
Description
${GroupDetailsURL}
${GroupFrequency}
${GroupID}
${GroupMemberDisplayName}
1231
Group Variables
so on.
${GroupMemberDisplayNamePlural}
${GroupMemberFullName}
${GroupMemberName}
${GroupMemberStatusID}
${GroupMemberStatusName}
${GroupMemberUri}
${GroupName}
1232
${GroupOwner}
SolarWinds product
appropriate to the group type
${GroupPercentAvailability}
${GroupStatusCalculatorID}
${GroupStatusCalculatorName}
${GroupStatusID}
${GroupStatusName}
${GroupStatusRootCause}
${NodeID}
SQL Query
Any value you can collect from the database can be generated, formatted, or
calculated using a SQL query as a variable. To use a SQL query as a variable in
SolarWinds SAM, use ${SQL:{query}} as shown in the following example that
returns the results of the SQL query Select Count(*) From Nodes:
${SQL:Select Count(*) From Nodes}
1233
Status Variables
Status Variables
When using the ${Status} variable with a monitored object, status values are
returned, as appropriate. The following table provides a description for each
status value:
Status Value Description
0
Unknown
Up
Down
Warning
Shutdown
Testing
Dormant
Not Present
Unmanaged
10
Unplugged
11
External
12
Unreachable
14
Critical
15
Mixed Availability
16
Misconfigured
17
19
Unconfirmed
1234
22
Active
24
Inactive
25
Expired
26
Monitoring Disabled
27
Disabled
28
Not Licensed
Node Variables
The following are valid node variables:
Node Variable
Description
${AgentPort}
${Allow64BitCounters}
${AvgResponseTime}
Average node
response time , in
msec, to ICMP
requests
${BlockUntil}
${BufferBgMissThisHour}
Device-dependent
count of big buffer
misses on node in
current hour,
queried with MIB
1.3.6.1.4.9.2.1.30
1235
Node Variables
${BufferBgMissToday}
Device-dependent
count of big buffer
misses on node in
current day, queried
with MIB
1.3.6.1.4.9.2.1.30
${BufferHgMissThisHour}
Device-dependent
count of huge buffer
misses on node in
current hour,
queried with MIB
1.3.6.1.4.9.2.1.62
${BufferHgMissToday}
Device-dependent
count of huge buffer
misses on node in
current day, queried
with MIB
1.3.6.1.4.9.2.1.62
${BufferLgMissThisHour}
Device-dependent
count of large buffer
misses on node in
current hour,
queried with MIB
1.3.6.1.4.9.2.1.38
${BufferLgMissToday}
Device-dependent
count of large buffer
misses on node in
current day, queried
with MIB
1.3.6.1.4.9.2.1.38
${BufferMdMissThisHour}
Device-dependent
count of medium
buffer misses on
node in current
1236
Device-dependent
count of medium
buffer misses on
node in current day,
queried with MIB
1.3.6.1.4.9.2.1.22
${BufferNoMemThisHour}
Count of buffer
errors due to low
memory on node in
current hour
${BufferNoMemToday}
Count of buffer
errors due to low
memory on node in
current day
${BufferSmMissThisHour}
Device-dependent
count of small buffer
misses on node in
current hour,
queried with MIB
1.3.6.1.4.9.2.1.14
${BufferSmMissToday}
Device-dependent
count of small buffer
misses on node in
current day, queried
with MIB
1.3.6.1.4.9.2.1.14
${Caption}
${Community}
Node community
1237
Node Variables
string
${Contact}
Contact information
for person or group
responsible for
node
${CPULoad}
Node CPU
utilization rate at
last poll
${CustomPollerLastStatisticsPoll}
${DNS}
${DynamicIP}
If node supports
dynamic IP address
assignment via
BOOTP or DHCP
(1); static IP
address return (0)
${EngineID}
Internal unique
identifier of the
polling engine to
which node is
assigned
${GroupStatus}
Filename of status
icon for node and,
1238
in SolarWinds
NPM, its interfaces
${IOSImage}
Family name of
Cisco IOS on node
${IOSVersion}
${IP_Address}
Node IP address
${LastBoot}
${LastSync}
${Location}
Physical location of
node
${MachineType}
Node manufacturer
or distributor and
family or version
information
${MaxResponseTime}
Maximum node
response time , in
msec, to ICMP
requests
${MemoryUsed}
${MinResponseTime}
Minimum node
response time , in
msec, to ICMP
requests
1239
Node Variables
${NextPoll}
${NextRediscovery}
${NodeID }
Internal unique
identifier of node
${ObjectSubType}
States if node
supports SNMP or
is ICMP-only
${PercentLoss}
${PercentMemoryUsed}
Percentage of total
node memory used
over polling interval
${PollInterval}
Node polling
interval, in seconds
${RediscoveryInterval}
Node rediscovery
interval, in minutes
${ResponseTime}
Node response
time, in
milliseconds, to last
ICMP request
${RWCommunity}
Node read/write
community string;
acts as security
code for read/write
SNMP access
${RWSNMPV3AuthKey}
SNMPv3 read/write
1240
credential
authentication key
${RWSNMPV3AuthKeyIsPwd}
States if the
SNMPv3 read/write
credential
authentication key
is the password
${RWSNMPV3AuthMethod}
SNMPv3 read/write
credential
authentication
method
${RWSNMPV3Context}
SNMPv3 read/write
security context
information
${RWSNMPV3PrivKey}
SNMPv3 read/write
credential key
${RWSNMPV3PrivKeyIsPwd}
States if the
SNMPv3 read/write
credential privacy
key is the password
${RWSNMPV3PrivMethod}
SNMPv3 read/write
credential privacy
encryption method
${RWSNMPV3Username}
${Severity}
A network health
score determined
additively by
scoring the status of
1241
Node Variables
monitored objects.
For example, in
SolarWinds NPM 1
point is provided for
an interface in a
warning state, 1000
points for a down
interface, and 1
million points for a
down node.
${SNMPV2Only}
${SNMPV3AuthKey}
SNMPv3
authentication key
${SNMPV3AuthKeyIsPwd}
States if node
SNMPv3
authentication key
is password
${SNMPV3AuthMethod}
SNMPv3
authentication type
${SNMPV3Context}
Group or domain of
user with SNMPv3
access to node
${SNMPV3PrivKey}
SNMPv3 credential
key
${SNMPV3PrivKeyIsPwd}
States if node
SNMPv3 credential
key is the password
${SNMPV3PrivMethod}
SNMPv3 credential
key type
1242
${SNMPV3Username}
${SNMPVersion}
${StatCollection}
Statistics collection
frequency, in
minutes
${Status}
Numerical node
status. For more
information, see
Status Variables
on page1234.
${StatusDescription}
${StatusLED}
Filename of node
status icon
${SysName}
String reply to
SNMP SYS_NAME
OID request
${SysObjectID}
Vendor ID of the
network
management
subsystem in OID
form. Clearly
determines the type
of node.
${SystemUpTime}
Time, in hundredths
of a second, since
network monitoring
started
1243
Volume Variables
${TotalMemory}
${UnManaged}
States if node is
currently
unmanaged
${UnManageFrom}
${UnManageUntil}
${Vendor}
Node manufacturer
or distributor
${VendorIcon}
Filename of node
vendor logo
Volume Variables
The following are valid volume variables:
Volume Variable
Description
${Caption}
${FullName}
${LastSync}
${NextPoll}
1244
${NextRediscovery}
${NodeID}
${PollInterval}
${RediscoveryInterval}
Volume rediscovery
interval, in minutes
${StatCollection}
Statistics collection
frequency, in minutes
${Status}
${StatusLED}
Number of volume
allocation errors for this
volume in current day
${VolumeDescription}
${VolumeID}
${VolumeIndex}
1245
${VolumePercentUsed}
Percentage of volume
currently in use
${VolumeResponding}
${VolumeSize}
${VolumeSpaceAvailable}
${VolumeSpaceUsed}
${VolumeType}
${VolumeTypeIcon}
Description
${APM_HardwareAlertData.HardwareStatus}
Current
hardware status
${APM_
Current
HardwareAlertData.HardwareStatusDescription} description of
1246
hardware status
${APM_HardwareAlertData.Manufacturer}
Manufacturer
${APM_HardwareAlertData.Model}
Hardware model
${APM_HardwareAlertData.ServiceTag}
Service
tag/Serial
Number
${APM_HardwareAlertData.LastPollTime}
${APM_HardwareAlertData.LastPollMessage}
Message or
error message
returned from
the last poll
${APM_HardwareAlertData.NodeName}
Name of the
node
${APM_HardwareAlertData.IsPollingDisabled}
Information
relating to nodes
for which polling
is disabled
${APM_HardwareAlertData.SensorsWithStatus}
Comma
separated list of
all child
hardware
components and
their statuses
${APM_HardwareAlertData.SensorsWithProblems} Comma
separated list of
all child
hardware
components (in
status other than
"Up") and their
statuses
1247
Descripti
on
${APM_
HardwareTypeAlertData.HardwareTypeStatus}
Rollup
status for
this
hardware
type
${APM_
HardwareTypeAlertData.HardwareTypeStatusDescri
ption}
Current
hardware
description
${APM_HardwareTypeAlertData.TypeName}
Type of
hardware
(Fan,
Battery,
and so
on.)
${APM_HardwareTypeAlertData.NodeName}
Name of
the node
${APM_HardwareTypeAlertData.SensorsWithStatus}
Comma
separated
list of all
child
hardware
componen
ts and their
statuses
${APM_
HardwareTypeAlertData.SensorsWithProblems}
Comma
separated
list of all
child
1248
hardware
componen
ts (in
status
other than
"Up") and
their
statuses
Node Hardware Sensor
The following are valid node hardware sensor variables:
Hardware Variable
Description
${HardwareTypeStatus}
${NodeName}
${SensorUniqueName}
${SensorDisplayName}
${SensorValue}
${SensorUnit}
${SensorOrionStatus}
Sensor status
${SensorOrionStatusDescription}
${SensorOriginalStatus}
1249
${SensorMessage}
Description
${IOReadOperationsPerSec}
${IOWriteOperationsPerSec}
${IOTotalOperationsPerSec}
${Threshold-IOReadOperationsPerSec-Warning}
${Threshold-IOReadOperationsPerSec-Critical}
${Threshold-IOWriteOperationsPerSec-Warning}
${Threshold-IOWriteOperationsPerSec-Critical}
${Threshold-IOTotalOperationsPerSec-Warning}
${Threshold-IOTotalOperationsPerSec-Critical}
Description
1250
${Contact}
${CriticalThresholdDays}
${DeviceTimeZone}
${DNSName}
${Domain}
${HardwareSerialNumber}
${HostName}
${Manufacturer}
${Model}
${NodeID}
${NodeName}
${OSArchitecture}
${OSVersion}
${ServicePack}
${SystemName}
${WarningThresholdDays}
1251
${WarrantyStatus}
l
l
Description
${AbreviatedDOW}
${AMPM}
${D}
${DD}
1252
padded)
${Date}
${DateTime}
${DayOfWeek}
${DayOfYear}
${H}
Current hour
${HH}
${Hour}
${LocalDOW}
${LongDate}
${M}
${MM}
${MMM}
${MediumDate}
${Minute}
${Month}
${N}
${S}
Current second.
${Second}
${Time}
${Year2}
${Year}
1253
Description
Copyright information
${DNS}
${IP_Address}
${Message}
Release information
${Severity}
${Version}
Description
${Copyright}
Copyright information
1254
${DNS}
${Hostname}
${IP}
${IP_Address}
${Message}
${RawValue}
${vbData1}
${vbName1}
Description
${AbbreviatedDOW}
${D}
${DD}
1255
${Date}
${DateTime}
${Day}
${DayOfWeek}
${DayOfYear}
${H}
Current hour
${HH}
${Hour}
${LocalDOW}
${LongDate}
${LongTime}
${M}
${MM}
${MMM}
${MMMM}
${MediumDate}
${MediumTime}
${Minute}
${MonthName}
${S}
Current second.
1256
${Second}
${Time}
${Year}
${Year2}
Script Macros
the following can be used with Windows, Linux/Unix, Nagios, and PowerShell
Script Monitors:
Macro
Description
${IP}
Current IP address
${USER}
Current User
${PASSWORD}
${CREDENTIAL}
${PORT}
${Node.SysName}
${Node.Caption}
${Node.DNS}
${Node.ID}
ID of the node
${Component.ID}
ID of the component
${Component.Name}
${Application.Id}
ID of the Application
1257
${Application.TemplateId}
Description
Description
Description
${USE_
Currently used baseline. Cannot be used with math functions.
BASELINE} Can only be used in the threshold fields of individual SAM
component monitors.
${MEAN}
1258
${STD_
DEV)
Notes:
${USE_BASELINE} cannot be used with math functions. To have this information
available for use as Warning and Critical thresholds, replace ${USE_BASELINE}
with the following formulas:
l
l
1259
Chapter 31:
Network Atlas
Network Atlas is a powerful tool for creating custom maps and network diagrams.
The maps created in Network Atlas enable users to view a graphical depiction of
their network in the SolarWinds Web Console. You can also use Network Atlas
maps to create your own network documentation, which can then be printed and
exported as needed.
What is in a Map?
Map objects can be SolarWinds SAM applications and components. The
numerous presentation options for your network maps include:
l
A large set of predefined background colors, textures, and images for use in
your maps, and the ability to use your own custom background graphics
The ability to project real time weather or natural disaster maps onto your
network maps using linked web graphics as a background
The ability to customize the shape, size, color, and style of map links to illustrate the status or the relative bandwidth of associated objects
The ability to show map objects in multiple styles to display application
status
Map nesting that selectively reveals increasing levels of map detail with the
status of child objects on nested maps bubbled up to the parent map
Linked Backgrounds
The linked backgrounds feature allows you to create maps with
backgrounds sourced directly from the Internet. Using a linked background,
you can create maps that include dynamic weather information relevant to
your distributed network sites. For more information, see Selecting a
Background Image.
AutoArrange
AutoArrange options allow you to quickly structure or reorganize objects on
your map. For more information, see Selecting Automatic Layout Styles."
1260
Example Maps
The following figures are examples of the types of maps you can create using
Network Atlas:
1261
Memory
1 GB
Hard Drive
Space
150 MB
Ports
1262
Operating
System
Memory
1 GB
Hard Drive
Space
150 MB
Ports
1263
b.
c.
d.
e.
1264
To view details about a map object, hover over it with the mouse
pointer.
To locate a specific map object in your map, click its network resource in the left
pane. This selects the map object.
Click Home.
Click Straight ( ) or Curved Line ( ) in the Lines group, as appropriate.
Click an object with the line drawing tool to begin drawing the link
Click and drag as needed to set optional anchor points along the link path.
Click a second object to finish drawing the link.
If you want the links connecting your mapped objects to communicate the status of connected interfaces, complete the following
steps:
a. Right-click a link, and then select Properties.
b. Select Status in the left pane of the Link Properties page.
c. Drag the appropriate interface objects from the left pane of the
SolarWinds Network window to the link status assignment areas.
1265
Adding a Background
You can select colors, textures, and locally-hosted or Internet-hosted images to
serve as your map backgrounds:
l
l
l
l
1266
Linked backgrounds are updated when the map is accessed or when the browser
page is refreshed. In a typical use case, a linked background is used to provide
weather data from an Internet weather service on a network map.
Notes:
l Files used for linked backgrounds must be continuously accessible by
URL reference.
l Files used for static backgrounds must be available within the local file system.
l Background images you supply display at their full size in the SolarWinds
Web Console, so consider their dimensions. You may rescale images
within the application, but images displayed at full scale provide optimal
quality.
l In determining map size and resolution, consider web page layouts and
potential display screen resolutions.
l Example background images are in the NetworkAtlas Backgrounds
folder located in your default shared documents folder. Clicking Background Image always starts you in this background images folder.
To select a background image:
1. Click Home.
2. If you want to use a background image from disk, click Background >
Background Image ( ), and then navigate to the image you want to use.
1267
).
Saving Maps
Network Atlas saves your maps directly to the server to which you are connected.
Note: To save a map to your hard drive instead of your SolarWinds server, click
> Export> Export Map.
To save a map:
1. Click the Network Atlas button ( ), and then click Save.
2. If you are saving the map for the first time, name the map, and then click
OK.
3. If you want to save your map to your hard drive, complete the following
steps:
a. Click > Export> Export Map.
b. Navigate to an appropriate location on your hard drive.
c. Provide a File name, and then click Save.
1268
Opening Maps
Maps are loaded from the SolarWinds server to which you are connected. They
appear in the left pane of the Network Atlas window.
To open a map:
1. Click [+] to expand the Maps group in the left pane of the Network Atlas
window.
2. Double-click the map you want to open.
1269
1270
Press and hold CTRL while rotating the mouse wheel button.
Click the Zoom slider on the status bar, and then slide the zoom control to the
zoom level you want
Click View, and then select the type of zoom you want to use from the Zoom
group.
1271
The map of Oklahoma can then become a parent map to a network diagram.
Each child map can include a view of the objects, either devices or other maps,
deployed on it. Any nested objects can then be clicked to view the next level of
map detail, until the level of the final network device is reached and all available
network information is displayed.
Note: The total number of objects on a map, including those displayed on child
maps, affects how fast the map loads in the SolarWinds Web Console. If your
maps load slowly, decrease the number of map objects.
1272
1273
1274
Icons added in this manner are also saved on the SolarWinds SAM server in the
path %APPDATA%\SolarWinds\NetworkAtlas\Maps\Orion\<orion server
1275
File name
Down status
iconName-down.gif
External status
iconName-external.gif
iconName.gif
Unknown status
iconName-unknown.gif
Unmanaged status
iconName-unmanaged.gif
Unplugged status
iconName-unplugged.gif
iconName-up.gif
Warning status
iconName-warning.gif
1276
1277
1278
1279
For more information about available tooltip variables, see Network Atlas Tooltip
Variables."
1280
Click View.
If you want grid lines, click Grid Option > Grid Lines.
If you want grid points, click Grid Options >Grid Points.
If you want to change the grid size, click Grid Options > Grid Size, and
then select a grid size.
Description
Align Left
Align Right
Align Bottom
Align Top
Center
Vertically
Center
Horizontally
1281
Description
Distribute
Distributes all objects so that they are
Horizontally equidistant from the left edge of the leftmost
object to the right edge of the rightmost object
Distribute
Vertically
1282
Map Properties
The Map Properties window allows you to configure options regarding the
following aspects of your map:
l
l
1283
1284
Application Variables
The following application variables are valid for use in Network Atlas tooltips:
1285
Variable
Description
${ApplicationID}
Application name
${NodeID}
${Status}
${StatusDescription}
${UnManaged}
Description
${ApplicationId}
${ComponentId}
${ComponentType}
${Name}
${Status}
1286
Description
${AbreviatedDOW}
${AMPM}
AM/PM indicator
${D}
${Date}
${DateTime}
${DayOfWeek}
${ DayOfYear}
${DD}
${H}
Current hour
${HH}
${Last24Hours}
${Last2Hours}
${Last7Days}
${LastHour}
${LocalDOW}
1287
General Variables
${M}
${MediumDate}
${Minute}
${MM}
${MMM}
${MMMM}
${S}
Current second.
${Second}
${Time}
${Today}
${Year}
${Year2}
${Yesterday}
General Variables
The following general variables are valid for use in Network Atlas tooltips:
Variable
Description
${Acknowledged}
Acknowledged status
${AcknowledgedBy}
${AcknowledgedTime}
1288
${Copyright}
Copyright information
${CR}
${ObjectName}
${Release}
Release information
${Version}
Node Variables
The following node variables are valid for use in tooltips:
Variable
Description
${AgentPort}
${Allow64BitCounters}
${AvgResponseTime}
Average node
response time , in
msec, to ICMP
requests
${BlockUntil}
${Caption}
${Community}
Node community
string
1289
Node Variables
${CPULoad}
Node CPU
utilization rate at
last poll
${CustomPollerLastStatisticsPoll}
${Description}
${DNS}
${DynamicIP}
If node supports
dynamic IP address
assignment via
BOOTP or DHCP
(1); static IP
address return (0)
${EngineID}
Internal unique
identifier of the
polling engine to
which node is
assigned
${External}
States if node is
currently
1290
designated as
external
${GroupStatus}
Filename of status
icon for node and its
interfaces
${IOSImage}
Family name of
Cisco IOS on node
${IOSVersion}
${IP_Address}
Node IP address
${LastBoot}
${LastSync}
${MachineType}
Node manufacturer
or distributor and
family or version
information
${MaxResponseTime}
Maximum node
response time , in
msec, to ICMP
requests
${MemoryUsed}
${MinResponseTime}
Minimum node
response time , in
msec, to ICMP
1291
Node Variables
requests
${NextPoll}
${NextRediscovery}
${NodeID}
Internal unique
identifier of node
${NodeName}
Node hostname.
Defaults to node IP
address ${IP_
Address} if
hostname does not
resolve.
${ObjectSubType}
States if node
supports SNMP or
is ICMP-only
${PercentLoss}
${PercentMemoryUsed}
Percentage of total
node memory used
over polling interval
${PollInterval}
Node polling
interval, in seconds
${RediscoveryInterval}
Node rediscovery
interval, in minutes
${ResponseTime}
Node response
time, in
milliseconds, to last
1292
ICMP request
${RWCommunity}
Node read/write
community string;
acts as security
code for read/write
SNMP access
${Severity}
A network health
score providing 1
point for an
interface in a
warning state, 1000
points for a down
interface, and 1
million points for a
down node.
${SNMPVersion}
${StatCollection}
Statistics collection
frequency, in
minutes
${Status}
Numerical node
status. For more
information see
Status Icons and
Identifiers in the
SolarWinds
Network
Performance
Monitor
Administrator
Guide.
${StatusDescription}
1293
Node Variables
status
${StatusLED}
Filename of node
status icon
${SysName}
String reply to
SNMP SYS_NAME
OID request
${SysObjectID}
Vendor ID of the
network
management
subsystem in OID
form. Clearly
determines the type
of node.
${SystemUpTime}
Time, in hundredths
of a second, since
monitoring started
${TotalMemory}
${UnManaged}
States if node is
currently
unmanaged
${UnManageFrom}
${UnManageUntil}
${Vendor}
Node manufacturer
or distributor
1294
Filename of node
vendor logo icon
${VendorIcon}
Volume Variables
The following volume variables are valid for use in Network Atlas tooltips.
Variable
Description
${Caption}
${FullName}
${LastSync}
${NodeID}
${Status}
${StatusLED}
Number of volume
allocation errors for this
volume in current day
${VolumeDescription}
1295
Wireless Variables
${VolumeID}
${VolumeIndex}
${VolumePercentUsed}
Percentage of volume
currently in use
${VolumeResponding}
${VolumeSize}
${VolumeSpaceAvailable}
${VolumeSpaceUsed}
${VolumeType}
${VolumeTypeIcon}
Wireless Variables
The following wireless variables are valid for use in Network Atlas tooltips:
Variable
Description
${WirelessAP}
${
1296
WirelessLastStatPoll } poller
${
Interval, in minutes, between wireless polling
WirelessPollInterval } attempts on node
${
Date and time node may be polled again by
WirelessStatBlockUntil wireless poller
}
Group Variables
The following group variables are valid for use in Network Atlas tooltips:
Variable
Description
${ContainerID}
${DetailsURL}
${Frequency}
${IsDeleted}
${LastChanged}
${Name}
${Owner}
${RollupType}
1297
Group Variables
${WebUri}
1298
Chapter 32:
Configuring Automatic Login
The SolarWinds SAM Web Console allows you to log in using any of the
following methods:
l
l
1299
StLouis\Bill
Note: For more information about creating accounts using the SolarWinds
Web Console Account Manager, see Creating Accounts on page297.
2. If you are using Local Computer Authentication Format for
passthrough accounts, create these accounts in the SolarWinds Web
Console Account Manager using Computer\UserID as the User Name, as
follows:
SolarWindsS2\Edward
Server3\JonesR
Note: For more information about creating accounts using the
SolarWinds Web Console Account Manager, see Creating
Accounts on page297.
3. Click Start> Control Panel> Administrative Tools> Internet Information Services (IIS) Manager.
4. If you are using Windows Server 2003, complete the following steps:
a. Expand Internet Information Services> Local Computer> Web Sites
in the left pane.
b. Select SolarWinds NetPerfMon.
c. Click Action> Properties.
d. Click the Directory Security tab.
e. Click Edit within the Authentication and access control area.
1300
1301
1302
Chapter 33:
Component Monitor Types
The available component monitors are as follows:
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
1303
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
1304
Field Descriptions:
The UDP port used for the DHCP request. The default value is 67.
UDP Response Port
The UDP port used for the DHCP response. The default value is 68.
Sender Adapter IP Address (optional)
For SolarWinds servers with multiple network adapters configuration, this
field specifies which of the multiple network adapters is used for the DHCP
User Experience monitor. If this setting is not specified, the default (primary)
network adapter is used.
Note: This setting does not affect SolarWinds servers with only one
network adapter.
DHCP Discovery Request Type
Select the DHCP Discovery Request Type:
Unicast This is the default DHCP Discovery Request Type. The
broadcast flag is not set, the ciaddr (Client IP Address) is set to the
local address, and the giaddr (Relay Agent IP Address) is not set. The
DHCP client sends a unicast DHCP DISCOVER to the DHCP server
IP address and the UDP Request Port (defaults to 67). The DHCP
server then sends a unicast DHCP Offer to the ciaddr address and the
UDP Response Port (defaults to 68).
This option can be used to monitor DHCP servers on the same subnet
as the SolarWinds SAM server or on a different subnet.
Broadcast The broadcast flag is set, the ciaddr (Client IP Address)
is set to the local address, and the giaddr (Relay Agent IP Address) is
not set. The DHCP client sends a unicast DHCP DISCOVER to the
DHCP server IP address and the UDP Request Port (defaults to 67).
The DHCP server then sends a broadcast DHCP Offer to the UDP
Response Port (defaults to 68).
This option can be used to monitor DHCP servers on the same subnet
as the SolarWinds SAM server
Relay Agent The broadcast flag is not set, the ciaddr (Client IP
Address) is set to the local address, and the giaddr (Relay Agent IP
Address) is set to the local address. The DHCP client sends a unicast
DHCP DISCOVER to the DHCP server IP address and the UDP
1305
1306
Statistic
Note: See Requirements for Component Monitors and Templates that use WMI,
on page 406 for information about requirements for WMI access.
Statistic
The disk space used in bytes.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that has read access to the file. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
Full directory Path
The path to the monitored directory. Specify the path in Universal Naming
Convention (UNC) format. For example: \\computername\c$\logfiles\. The
path can include the variable ${IP}, which represents the target node's IP
address.
File Extensions Filter
Determines which file extensions are included in the disk space usage
calculations for the directory size. It is a text matching filter, and * is a
wildcard.
Include Subdirectories
Determines whether the contents of sub-directories are included in the disk
space usage calculations for the directory size.
Convert Value
1307
1308
1309
1310
1311
1312
1313
1314
1315
1316
1317
1318
1319
1320
Field Descriptions:
Credential for Monitoring
Select a credential that has read access to the file. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
File Path
This field is the path to the monitored file, including the file name. Specify
the path in Universal Naming Convention (UNC) format. For example:
\\computername\c$\logfile\errors.log. The path can include the variable
${IP} which represents the target node's IP address.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the drop down lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Current Snapshot Checksum
This field is the calculated checksum against which SolarWinds SAM is
comparing the monitored file. To calculate a new checksum, click Update
Checksum.
Select and upload a file for snapshot creation
This field is the local path to a file on the user's computer (where the web
browser is running) used to calculate the checksum against which the
monitored file is compared. Click Browse to open a Windows Choose File
dialog from which you can select the file directly. Click Update Checksum
to calculate the new checksum.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 15.
Statistic Critical Threshold
This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the drop down followed
1321
1322
1323
1324
Field Descriptions:
Select a credential that can log on to the FTP server. For example, to
monitor an anonymous FTP server, select or add a credential containing
anonymous as the user name and your email address as the password. If
the credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Port Number
This field is the port number used for FTP sessions. The default value is 21.
Url
Allows you to specify the URL of the file you want to monitor. The URL can
include the variable ${IP} which represents the target node's IP address,
and the variable ${PORT} which represents the value in the Port Number
field.
Use Proxy
This check box allows you to use a web proxy to access the web site.
Proxy Address
This field allows you to specify the address of a web proxy to access the
web site.
Passive Mode
This check box allows you to monitor the file using passive mode FTP. This
mode is typically used to circumvent a firewall that would otherwise filter the
incoming connection to the SolarWinds SAM server.
Current Snapshot Checksum
This field is the calculated checksum against which SolarWinds SAM is
comparing the monitored file. To calculate a new checksum, click Update
Checksum.
Select and upload a file for snapshot creation
This field is the local path to a file on the SolarWinds SAM server that is
used to calculate the checksum against which the monitored file is
compared. Click Browse to open a Windows Choose File dialog from
which you can select the file directly. Click Update Checksum to calculate
the new checksum.
Response Time Warning Threshold
1325
FTP Monitor
This component monitor tests the ability of an FTP server to accept incoming
sessions and respond with the correct codes.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
This field is the port number used for FTP sessions. The default value is 21.
Response Time Warning Threshold
1326
1327
1328
Field Descriptions:
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that can log on to the web site. If the credential you need
is not already present in the credentials list, use the Quick Credentials
section to add a new credential.
Port Number
This field is the port number used for HTTP forms-based login sessions.
The default value is 80.
Url
Allows you to specify the URL you want to monitor. The SolarWinds SAM
variable ${IP} contained in the default value for this field attempts to monitor
a web site at the IP address of the assigned node.
Host Header
Enter the address of the host header. For example, www.solarwinds.com.
Use Proxy
This check box allows you to use a web proxy to access the web site.
Proxy Address
This field allows you to specify the address of a web proxy to access the
web site.
Ignore CA Errors
If checked, this indicates that Certificate Authorization (CA) errors will be
ignored.
Ignore CN Errors
If checked, this indicates that Common Name (CN) errors will be ignored.
Accept Compression
If checked, indicates that compression is supported.
Login Form Keywords
This field lists the expected keywords that identify an HTML login form. The
keywords are matched against the name attribute of the <form> tags found
in the HTML of the login page. Each keyword in this list must be enclosed in
1329
1330
HTTP Monitor
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"
HTTP Monitor
This component monitor tests a web server's ability to accept incoming sessions
and transmit the requested page. The component monitor can optionally search
the delivered page for specific text strings and pass or fail the test based on that
search.
The HTTP Monitor measures the time it takes the HTTP get for the page
referenced in the component monitor to load. This response time is measured in
milliseconds.
Note: If a web page redirects to another page, the response time measures the
entire time from the original request until the last redirected page is loaded.
This monitor supports the following additional macros:
l
l
l
l
${Node.SysName}
${Node.Caption}
${Node.DNS}
${Node.ID}
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
1331
Host Header
Enter the address of the host header. For example, www.solarwinds.com.
Host Request
Enter the type of content. For example, POST.
Content Type:
Enter the type of content. For example, application/json.
Request Body:
Enter the type of content. For example:
{
"firstname": "Kate"
"lastname": "Asaff"
"age" : 29
1332
Field Descriptions:
"city" : "Austin"
}
Follow Redirect
This allows you to specify the component monitor to automatically follow
server-side redirects.
Use Proxy
This check box allows you to use a web proxy to access the web site.
Proxy Address
This field allows you to specify the address of a web proxy to access the
web site.
User Agent
This field allows you to emulate a specific user agent or browser type when
contacting the web site. For example, to emulate Internet Explorer version 7,
type Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0). For more
information about user agent strings, see http://www.useragentstring.com
Search String
This field contains the text string indicating successful page retrieval. If the
specified string is found in the web page content, the monitor is considered
up.
Note: The search string is not case-sensitive.
Fail if Found
This check box allows you to reverse the default behavior of the search
string. If the search string is found in the web page content, the monitor is
considered down instead of up.
Head Request
This field allows you to ensure the web site responds to the HTTP protocol,
but without checking the validity of the web page content. Search strings are
ignored if you select this option.
Accept Compression
If checked, indicates that compression is supported.
Response Time Warning Threshold
1333
HTTPS Monitor
This component monitor tests a web server's ability to accept incoming sessions
over a secure channel and then transmit the requested page. The component
monitor can also test the security certificate.
The HTTPS Monitor measures the time it takes the HTTPS get for the page
referenced in the component monitor to load. This response time is measured in
milliseconds.
Note: If a web page redirects to another page, the response time measures the
entire time from the original request until the last redirected page is loaded.
This monitor supports the following additional macros:
l
l
l
l
${Node.SysName}
${Node.Caption}
${Node.DNS}
${Node.ID}
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
1334
Field Descriptions:
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
If the web site is password-protected, select a credential that can access the
web site. If the credential you need is not already present in the credentials
list, use the Quick Credentials section to add a new credential.
Port Number
The port used by the web site. The default value is 443.
Url
This field allows you to specify the URL you want to monitor. The
SolarWinds SAM variables contained in the default value for this field
attempt to monitor a web site at the IP address of the assigned node ${IP}
and on the port specified in the Port Number field ${PORT}.
Proxy Servers: To prevent proxy servers from caching the monitored URL,
you can append a unique query string to the URL with the ${TimeStamp}
variable.
Example "cache buster" for simple URL: http://${IP}:${Port}/?_
cb=${TimeStamp}
Example "cache buster" for URL with existing query string:
http://${IP}:${Port}/?page.aspx?var=value&_cb=${TimeStamp}
Host Header
Enter the address of the host header. For example, www.solarwinds.com.
Host Request
Enter the type of content. For example, POST.
Content Type:
1335
"firstname": "Kate"
"lastname": "Asaff"
"age" : 29
"city" : "Austin"
}
Follow Redirect
This allows you to specify the component monitor to automatically follow
server-side redirects.
Use Proxy
This check box allows you to use a web proxy to access the web site.
Proxy Address
This field allows you to specify the address of a web proxy to access the
web site.
Certificate Subject
This is used for selecting a private key when client authentication is used.
This field allows you to specify the X.509 certificate subject (DN). Use
spaces () or commas (,) to separate the different subject fields. Semicolons,
commas with spaces after them, and newline or carriage returns are not
acceptable separators.
It allows you to select a certificate from Current User > Personal
certificate store using its subject. The subject must equal the exact
format to find the certificate using .NET.
For example: To find a specific certificate, you need to use the
following format:
CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE
Ignore CA Errors
This check box allows you to specify the component monitor to ignore the
certificate authority (CA).
1336
Field Descriptions:
Ignore CN Errors
This check box allows you to specify the component monitor to ignore the
certificate name (CN).
User Agent
This field allows you to emulate a specific user agent or browser type when
contacting the web site. For example, to emulate Internet Explorer version 7,
type Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0). For more
information about user agent strings, see http://www.useragentstring.com
Search String
This field contains the text string indicating successful page retrieval. If the
specified string is found in the web page content, the monitor is considered
up.
Note: The search string is not case-sensitive.
Fail if Found
This check box allows you to reverse the default behavior of the search
string. If the search string is found in the web page content, the monitor is
considered down instead of up.
Head Request
This check box allows you to ensure the web site responds to the HTTPS
protocol, but without checking the validity of the web page content. Search
strings are ignored if you select this option.
Accept Compression
If checked, indicates that compression is supported.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
1337
IMAP4 Monitor
This component monitor tests the ability of an IMAP4 server to accept incoming
connections and respond with the correct code.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
This field is the port number used for IMAP4 sessions. The default value is
143.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
1338
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that can retrieve email from an IMAP4 server. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential. Credentials used for
this monitor should be the user for whom the mailbox will be monitored.
Send Email From
This field allows you to specify the From address of the test email message.
1339
1340
JMX Monitor
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"
JMX Monitor
This template tests the overall performance of a Java Application Server
Prerequisites: The JMX connector must be enabled on the Java application
server.
Credentials: You may need either JMX credentials or none at all. This depends
on the credentials required based on the configuration of your Java application
server. For more information, see Configuring Java Applications Servers for
JMX."
Important: Polling via the JMX Component Monitor is not supported using an
agent.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
This describes the type of monitor you are using.
Enable Component
This option determines whether or not the component is enabled. Disabling
this component leaves it in the application as deactivated and does not
influence application availability or status.
Credential for Monitoring
This allows you to set JMX credentials for querying MBeans. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Port Number
1341
1342
1343
1344
1345
${UserDescription}.
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Authentication Type
Choose either Username and Password or Username and Private Key. The
second option allows you to use cetificates for authentication. For more
information, see "Certificate Credentials Library" on page 339.
Credential for Monitoring
Select a credential that can access the Linux or Unix server over SSH, and
that has sufficient rights to run scripts. If the credential you need is not
already present in the credentials list, use the Quick Credentials section to
add a new credential.
Port Number
This field allows you to specify the port number used for the SSH
connection. The default value for this field is 22.
Script Working Directory
This field allows you to specify the working directory of the script
process.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Command Line
This field allows you to specify the shell command run after the SSH
connection is established. The default command line value perl ${SCRIPT}
arg1 arg2 attempts to run in a Perl interpreter the script defined in the Script
Body field using the parameters arg1 arg2.
Note: The length of the Command Line field is limited to 266
characters for Solaris systems, minus the length of the ${SCRIPT}
variable after being resolved to a file name such as the following:
1346
1347
1348
Field Descriptions:
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that is both a user who can log on to the SolarWinds
SAM server, and that has an Exchange account on the MAPI server. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential. Credentials used for
this monitor should be the user for whom the mailbox will be monitored.
Send Email From
This field allows you to specify the From address of the test email message.
Send Email To
This field allows you to specify the recipient of the test email message. The
recipient should have a mailbox on the MAPI server you are monitoring.
MAPI Profile Name
Allows you to specify the name of the MAPI profile
SMTP Server
This field allows you to specify the SMTP server that sends the test email
message.
SMTP Port
This field is the port number used for SMTP sessions. The default value is
25.
Use Credentials for SMTP
This check box allows you to use the user name and password from
Credentials for Monitoring to connect to SMTP servers that support or
require authentication.
SMTP Encryption
1349
1350
Field Descriptions:
This option determines whether or not the component is enabled. Disabling
this component leaves it in the application as deactivated and does not
influence application availability or status.
Credential for Monitoring
Select a Windows credential that is both a user who can log on to the
SolarWinds SAM server, and has sufficient rights on the target node to do
whatever the script needs to do. For example, if the script does something
with WMI, the credentials also need WMI rights on the target node. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Port Number
This field allows you to specify the port number used for the SSH
connection. The default value is 22.
Script Working Directory
This field allows you to specify the working directory of the script
process.
Check Type
This determines how the return code is evaluated.
Return Code Service State Host State
0
OK
Up
Warning
Up or Down/Unreachable
Critical
Down/Unreachable
Unknown
Down/Unreachable
_______________________
If the Use Aggressive Host Checking option is enabled, return codes
of 1 will result in a host state of DOWN, otherwise return codes of 1
will result in a host state of UP.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
1351
NNTP Monitor
This component monitor tests the ability of an NNTP server to accept incoming
connections and respond with the correct code.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts".
Enable Component
1352
1353
1354
1355
1356
Statistic
query, and then retrieves the data. Oracle Net Services from the Oracle Client
must be installed on the SolarWinds SAM server.
The SQL statement you use for this query must return a numerical value, not a
varchar.
Statistic
The statistic for this component monitor is the first row and column of
the data retrieved by the query. It must be a numerical value.
Install Oracle Client on the SolarWinds SAM Server.
This component monitor requires you to install the Oracle Net
Services from the Oracle Client on your SolarWinds SAM server. You
can download the Oracle Client from:
l
TCP Ports
This component monitor uses ports TCP/1521 and TCP/1526. The
Oracle SQL*Net Listener allows Oracle client connections to the
database over Oracle's SQL*Net protocol. You can configure it during
installation. To reconfigure this port, use Net Configuration Assistant.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
1357
1358
Field Descriptions:
ORA11 = (DESCRIPTION = (ADDRESS_LIST = (ADDRESS =
(PROTOCOL = TCP)(HOST = 127.0.0.1)(PORT = 1521)))
(CONNECT_DATA = (SERVICE_NAME = sales.us.example.com)
))
Example of a SID as a destination point name
Destination Point Name: ORA11DATABASE
Destination Point Type: SID
tnsnames.ora:
1359
1360
1361
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
1362
Field Descriptions:
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
Identifies the component type as a Performance Counter Monitor.
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a Windows credential that has RPC access to the target node. This
is typically a Windows administrator-level credential.
Count statistic as difference
This option changes the statistic to be the difference in counter values
between polling cycles.
Counter
Enter the name of the performance counter. For example:
%ProcessorTime.
Instance
Enter the instance name of the performance counter. For example: _Total.
If the performance counter has multiple instances, you can monitor each
instance separately by creating a Performance Counter Monitor for each
instance. For example, the performance counter %ProcessorTime has
two instances if you have a dual-CPU system: 0 for the first CPU and 1 for
the second CPU. You can create a separate Performance Counter Monitor
to monitor each instance of the counter.
Category
Enter the category of the performance counter. All performance counters are
assumed to exist within the root/CIMV2 namespace. For example:
Processor.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
1363
POP3 Monitor
This component monitor tests the ability of a POP3 server to accept incoming
connections and respond with the correct code.
This component monitor uses the following ports when used with a Microsoft
Exchange mail server:
l
l
l
l
l
l
l
l
l
102
110
119
143
389
563
636
993
995
X.400 MTA
POP3
NNTP
IMAP4
LDAP
POP3 over SSL.
LDAP over SSL.
IMAP4 over SSL.
POP3 over SSL.
1364
Statistic
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
This field is the port number used for POP3 connections. The default value
is 110. For Secure POP3 (SSL-POP) use port 995.
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"
1365
1366
1367
1368
1369
1370
Connect to server.
Send RADIUS credential and shared secret.
Validate response.
Measure response time.
Important: This component monitor will not work using an agent as the polling
method.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
1371
Running
Continue Pending
Pause Pending
Paused
Statistic
The statistic for this component monitor is the value for one of the
reported statuses: 1-4.
Field Descriptions:
Description
1372
SMTP Monitor
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Net Service Display Name
This field is the Display name of the service to monitor. You can find the
Display name on Windows systems by clicking Start> Administrative
Tools> Services and then locating the desired service. The Display name
for the service is the value in the Name column.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 15.
Statistic Critical Threshold
This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 5.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"
SMTP Monitor
This component monitor tests the ability of an SMTP server to accept incoming
connections and respond with the correct code.
1373
1374
SNMP Monitor
SNMP Monitor
This component monitor uses the SNMP protocol to retrieve an entry in a
Management Information Base (MIB) by its Object Identifier (OID), and returns the
value of the entry as a statistic.
Statistic
Value of the entry retrieved from the MIB.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
Describes how the component monitor works.
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Method Type
Get - A manager-to-agent request to retrieve the value of a variable or list of
variables. Desired variables are specified in variable bindings (values are
not used). Retrieval of the specified variable values is to be done as an
atomic operation by the agent. A Response with current values is returned.
Get Next - A manager-to-agent request to discover available variables and
their values. Returns a Response with variable binding for the
lexicographically next variable in the MIB. The entire MIB of an agent can
be walked by iterative application of GetNextRequest starting at OID 0.
Rows of a table can be read by specifying column OIDs in the variable
bindings of the request.
Object Identifier (OID)
Specify the OID of the entry in the MIB you want to retrieve.
1375
1376
Field Descriptions:
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Component Type
This describes the type of monitor you are using.
Enable Component
This option determines whether or not the component is enabled. Disabling
this component leaves it in the application as deactivated and does not
influence application availability or status.
Credential for Monitoring
Select the credentials needed for monitoring this component.
SOAPXMLRequest
You can either choose to load XMLfrom a WSDLfile or manually enter the
XML. If you choose to manually enter the SOAPXMLrequest, you must
populate the following fields:
Manually entering the SOAPXML request displays the following fields:
l
l
l
SOAPVersion: Select either 1.1 or 1.2 from the drop down list.
SOAPXML: This is the XMLenvelope.
1377
HTTPUser Agent
This identifies the client that is making the request. For example,
Google Chrome identifies itself as Mozilla/5.0 (Windows NT 6.2;
Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
Chrome/32.0.1667.0 Safari/537.36 Some web services may behave
differently based on the user agent.
HTTPContent Type
Indicates the format of the content of the message. With SOAP, this
can either be application/soap+xml or text/xml.
Accept Compression
1378
Field Descriptions:
Indicates to the server whether or not the client supports compression
of the data.
Certificate Subject
The subject of the certificate to match against.
Ignore CAErrors
Decide whether or not to ignore any errors verifying the Certificate
Authority. This can occur if the certificate is self-signed or if the
certificate was not installed correctly on the server.
Ignore CN Errors
Ignore Common Name error. This occurs when the Common Name of
the certificate does not match the name of the server that is in the
URL.
Use Proxy
This option allows you to tell the monitor whether or not it is going through a
proxy connection.
Proxy Address
Enter the address for the proxy connection, if enabled.
Search String
Allows you to enter a string to test for its presence.
Fail if Found
Select either Yes or No to determine if this monitor reports a status of Fail if
the string is found.
Response Time Threshold
Select and enter appropriate thresholds for Warning and Critical statuses.
For more information, see Application Monitor Thresholds.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts.
For more information, see:
1379
l
l
SOAP Monitor
Web Service Monitoring
1380
Field Descriptions:
This field allows you to specify the SQL query used to test the database.
The retrieved data is then used as the component monitor statistic. You may
enter up to 4000 characters.
SQL Server Instance
This field allows you to specify the SQL Server instance required to access
the SQL Server database. Enter only the instance name. Do not prefix the
instance name with the server name. To access the default instance, leave
this field blank.
Initial Catalog
This field allows you to specify the initial database (catalog) for the
connection.
Use Windows Authentication first, then SQL authentication
Select this check box to access a SQL Server that supports or requires
Windows Authentication, and specifies that the credential is a Windows
credential instead of a SQL Server credential.
Query Timeout
Allows you to specify when this query should timeout in seconds. The
default timeout period is 30 seconds.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the drop down lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
1381
1382
Field Descriptions:
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Port Number
The default value for this port is 443.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the drop down lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Response Time Warning Threshold
This field allows you to set the warning threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Response Time Critical Threshold
This field allows you to set critical threshold conditions based on the
response time. The response time is the time in milliseconds it takes
SolarWinds SAM to determine that a component is not Down and to retrieve
any statistical data.
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 15.
Statistic Critical Threshold
This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 5.
User Notes
1383
Connect to server.
Send TACACS+ credential and shared secret.
Validate response.
Measure response time.
Important: This component monitor will not work using an agent as the polling
method.
Statistic
This component monitor does not compute a statistic.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a TACACS+ credential or create one in the Quick Credentials
section.
Port Number
This field is the TACACS+ protocol connection port. The default value is 49.
1384
1385
1386
Field Descriptions:
Max Memory
Maximum size of the heap space not including the permanent generation
area.
Total Processing Time
Total processing time in milliseconds since server start.
Total Request Count
Total requests from server since server start.
Total Bytes Sent
Total bytes sent from server since server start.
Total Bytes Received
Total bytes sent to server since server start.
Total Error Count
Total error count from all request processors.
Field Descriptions:
Description
This field provides a default description of the monitor. You have the ability
to override the default description by adding to or replacing the text, which
will then be automatically saved. The variable to access this field is
${UserDescription}. For more information, see Configuring SolarWinds
SAM Alerts"
Enable Component
Determines whether the component is enabled. Disabling the component
leaves it in the application in a deactivated state not influencing either
SolarWinds SAM application availability or status.
Credential for Monitoring
Select a credential that can access the password-protected portion of the
web site. If the credential you need is not already present in the credentials
list, use the Quick Credentials section to add a new credential.
Port Number
This field allows you to specify the port number used by the web site. The
default value for this field is 8080.
1387
1388
Statistic
The statistic for this component monitor is the value of the
performance counter data retrieved by the VMware API.
Optionally, the statistic may be set as the difference in retrieved values
between polling cycles by checking the option for Count statistic as
difference.
Note: the Count statistic as difference option is applicable only for
monitors whose counter value increases consistently during each
polling interval. Examples of when this option is not applicable include
cases such as the following:
l
1389
1390
Field Description:
(Only applicable if you are monitoring VirtualCenter Server) Data
object that aggregates the computation resources of its associated
Host System objects into one single computation resource for use by
virtual machines. The cluster services such as HA (High Availability),
DRS (Distributed Resource Scheduling), and EVC (Enhanced
vMotion Compatibility), enhance the usefulness of this single
computation resource. This Entity Type is specific to vCenter systems.
Host System Managed object type that provides access to a virtualization host
platform.
Resource Pool Represents a set of physical resources which may be a
single host, a subset of a host's resources, or resources spanning multiple
hosts. You can subdivide Resource pools by creating child resource pools.
In order to run, a virtual machine must be associated as a child of a
resource pool. In a parent/child hierarchy of resource pools and virtual
machines, the root resource pool is the single resource pool that has no
parent pool.
Virtual Machine Managed object type for manipulating virtual machines,
including templates that can be repeatedly deployed as new virtual
machines. This object type provides methods for configuring and controlling a virtual machine.
Entity Name
Specifies the VMware entity name to monitor, for example VirtualMachine1.
For VMs, you can view these values using the VMware console.
This field may contain the special ${VMWARE_ENTITY_NAME} variable.
When the monitor runs, this variable will be resolved to the first available
entity on a target host with the desired Entity Type (for example, the first
Host System). For more information, refer to the Multiple systems case in
step 11 of the section Monitoring VMware Performance Counters on page
156.
Group
Specifies the VMware group to which the counter belongs, for example:
CPU, memory, and so forth.
Counter
Specifies the VMware counter to fetch, for example: coreUtilization, and so
forth.
1391
VMware ESX Performance Counter Monitor monitors performance counters for ESX servers
VMware vCenter Performance Counter Monitor monitors
performance counters for vCenter servers
Rollup Type
Specifies the way to roll up the VMware counter data, for example: average,
latest, summation, and so forth.
Instance
Specifies the instance to be fetched, for example: 0, 1, 2, and so forth.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the drop down lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 15.
Statistic Critical Threshold
This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 5.
User Notes
1392
1393
1394
1395
Event Type
1396
Field Descriptions:
Select Any Event to match any event type in the log, or select a
specific event type to further restrict the match criteria.
User who generated Events
Enter a user name to further restrict the match criteria. Leave this field
blank to match any users. Enter "N/A" to select only events with no
specific user.
Include events
Select With Keywords Below to specify keywords or phrases as the
match criteria. Select Matching Regular Expression Below to
specify regular expressions that match text that appears in the events.
For information about the regular expressions syntax, see .NET
Framework Regular Expressions, http://msdn.microsoft.com/enus/library/hs600312%28VS.80%29.aspx.
Exclude events
Select With Keywords Below to specify keywords or phrases as the
match criteria. Select Matching Regular Expression Below to
specify regular expressions that match text that appears in the events.
For information about the regular expressions syntax, see .NET
Framework Regular Expressions, http://msdn.microsoft.com/enus/library/hs600312%28VS.80%29.aspx.
Number of past polling intervals to search for events:
Enter the number of polling intervals worth of time you want to search
the event logs. For example, to always search the past 20 minutes of
event logs, you could set the application polling interval to five
minutes and then set the Number of Past Polling Intervals to four (4 x
5mins = 20mins). Fractional values are valid.
Collect Detailed Data of Matched Events
Message and other details of matched events will be available for
viewing and alerting when enabled.
If a match is found in a polling period, component is:
1397
Based on Event Types: With this option, the result status of the component
monitor will never be down for a successful poll:
o Critical (When there is at least one event with a severity of Error or
FailureAudit.)
o Warning (When there is at least one event with a severity of Warning.)
o Up (When all matched events are either Informational or SuccessAudit.)
Based on Event Count: With this option, the status of the component monitor will never be down for a successful poll and the thresholds for the
returned value will be applied against the number of matched events.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the drop down lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 15.
Statistic Critical Threshold
This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 5.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"
1398
1399
l
l
Local Host can run scripts only locally, that is, on the
SolarWinds SAM server. This is the default value.
Remote Host can execute scripts remotely (on the selected target node) using the Windows Remote Management (WRM) system component. WRM should be configured separately to get it
working with the Windows PowerShell monitor.
If Remote Host is selected, the following options are available:
Use HTTPS Protocol if checked, specifies that the secure
HTTPS protocol should be used to send and receive WS-Management protocol requests and responses. Otherwise the HTTP
protocol is used.
URL Prefix specifies a URL prefix on which to accept HTTP
or HTTPS requests. The default is wsman.
Port Number specifies the TCP port for which this listener is
created. For WinRM 1.1 and earlier, the default HTTP port is 80.
For WinRM 2.0, the default HTTP port is 5985.
Script Body
1400
1401
VBScript
.vbs
Installed by default
1402
Field Descriptions:
JScript
.js
Installed by default
PerlScript
.pls
Freeware
ooRexxScript
.rxs
Freeware
PythonScript
.pys
Freeware
TclScript
.tcls
Freeware
ActivePHPScript
.phps
Freeware
RubyScript
.rbs
Freeware
Commercial
Commercial
1403
SAM will poll the service state, and information about CPU/memory
usage will be retrieved using performance counters.
Net Service Name
1404
WMI Monitor
This field is the Service name of the service to monitor. You can find the
Service name on Windows systems by clicking Start> Administrative
Tools> Services and then locating the desired service. Right-click the
service and select Properties from the context menu. The Service name is
the value of the Service name field in the Properties dialog.
CPU Threshold
These fields allow you to set warning and critical threshold conditions
based on the percentage of CPU resources in use by the monitored
process.
Physical Memory Threshold
These fields allow you to set warning and critical threshold conditions
based on the percentage of physical memory in use by the monitored
process.
Virtual Memory Threshold
These fields allow you to set warning and critical threshold conditions
based on the percentage of virtual memory in use by the monitored process.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"
WMI Monitor
Formerly known as the WMI Performance Counter Monitor, this component
monitor uses WMI communication to obtain the result of a WMI Query Language
(WQL) query. The typical result retrieves the performance data calculated by WMI
providers such as the Windows operating system or Microsoft Exchange Server.
All WQL queries are run within the root/CIMV2 namespace.
Note: Named instances of SQL Server may have custom class names that do not
match the built-in templates. You must manually change the class name in any
WMI Monitor monitoring a named SQL Server instance. For example, if the
named instance is "NAMED, you must change Win32_PerfFormattedData_
MSSQLSERVER_SQLServerBufferManager to Win32_PerfFormattedData_
MSSQLNAMED_SQLNAMEDServerBufferManager.
1405
1406
Field Descriptions:
WMI Namespace
Specifies the name of the namespace within which all WQL queries are run.
The default value is root\CIMV2.
WQL Query
Type the WQL query you want to run on the target node. This is typically a
performance counter Query, but it can be any WQL query. All WQL queries
are run within the root/CIMV2 namespace. The WQL query for this monitor
returns a numeric value. It will not report errors.
Count Statistic as Difference
Changes the statistic to be the difference in query values between polling
cycles.
Convert Value
Checking the Convert Value check box opens the Formula box.
From here, you have the ability to manipulate the returned value with a
variety of mathematical possibilities. You can choose common
functions from the drop down lists to manipulate the returned value, or
you can select the Custom Conversion option. For more information,
see "Conversion Value."
Statistic Warning Threshold
This field allows you to specify when a threshold that indicates a warning
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 15.
Statistic Critical Threshold
This field allows you to specify when a threshold that indicates a critical
level has been breached. Logical operators are in the drop down followed
by a blank field for you to enter the value of this threshold. For example:
Less than 5.
User Notes
This field allows you to add notes for easy reference. You can access this
field by using the variable, ${UserNotes}. For more information, see
Configuring SolarWinds SAM Alerts"
1407
Chapter 34:
Filter Syntax Reference
Filters are optional database queries that you can add limit the Orion objects
listed inside a resource. You can apply filters based on any Orion object property,
be it custom or pre-defined within a resource, to help you better interpret the
monitoring data shown in the resources.
To apply a resource filter:
1. Click Edit in any resource that lists Orion objects.
2. Click Show Filter Examples > Show List of Properties to list the properties you can use for the filter criteria
3. Provide appropriate filter criteria in the Filter Nodes field and then click Submit.
Filter Syntax
There are two slightly different filter syntax types: Structured Query Language
(SQL) syntax and SolarWinds Query Language (SWQL) syntax. The two main
differences between SQL and SWQL are:
l
l
SQL or SWQL?
It is not always obvious whether a resource requires SQL syntax or SWQL syntax
filters. Generally, the resources that have most recently been added to
SolarWinds Orion use SWQL syntax, while the oldest ones require SQL syntax.
1408
1409
Unknown
Up
Down
Warning
14
Critical
Example filter to only show monitors that are not down:
MonitorStatus.Availability<>2
Example filter to show only Nortel devices that are Down: Vendor Like
'Nortel*' AND Status=2
Filtering by Status
To filter by the status, you must know the valid status levels:
1410
Level Status
0
Unknown
Up
Down
Warning
14
Critical
Example filter to only show monitors that are not down:
MonitorStatus.Availability<>2
EOC Filters
All Enterprise Operations Console (EOC) resources use SWQL filtering:
Alert Resource Filters
Resource
Alert
Orion
SWQL
Name
EOC.APM.Application
EOC.APM.ApplicationTemplate
AT
1411
EOC.APM.CurrentApplicationStatus
CAS
EOC.Node
EOC.Orion
Orion
EOC.APM.CurrentApplicationStatus
Status
EOC.Orion
Orion
EOC.APM.Application
EOC.APM.ApplicationTemplate
AT
EOC.APM.CurrentApplicationStatus
CASN.
EOC.Node
EOC.Orion
Orion
EOC.APM.Application
EOC.APM.ApplicationTemplate
AT
EOC.APM.CurrentApplicationStatus
CAS
EOC.Node
EOC.Orion
Orion
EOC.APM.Application
EOC.APM.ApplicationTemplate
AT
EOC.APM.CurrentApplicationStatus
CAS
EOC.Node
EOC.Orion
Orion
EOC.APM.Application
EOC.APM.ApplicationTemplate
AT
EOC.APM.CurrentApplicationStatus
CAS
EOC.Node
EOC.Orion
Orion
EOC.APM.Application
1412
EOC.APM.CurrentApplicationStatus
CAS
EOC.Node
EOC.Orion
Orion
EOC.APM.Application
EOC.APM.ApplicationTemplate
AT
EOC.APM.CurrentApplicationStatus
CAS
EOC.APM.CurrentStatistic
CS
EOC.Node
EOC.Orion
Orion
EOC.APM.Application
EOC.APM.CurrentComponentStatus CCS
EOC.APM.CurrentStatistic
CS
EOC.Node
EOC.Orion
Orion
EOC.APM.Application
EOC.APM.CurrentComponentStatus CCS
EOC.APM.CurrentStatistic
CS
EOC.Node
EOC.Orion
Orion
EOC.APM.Application
EOC.APM.CurrentComponentStatus CCS
EOC.APM.CurrentStatistic
CS
EOC.Node
EOC.Orion
Orion
EOC.APM.ApplicationTemplate
AT
EOC.Orion
1413
Events Filters
Events Filters
Resource
Event
EOC.EventType
EventType
EOC.Orion
Orion
EOC.Event
Event
EOC.EventType
EventType
EOC.Node
Node
EOC.Orion
Orion
Inventory Filters
Resource
EOC.Interface
EOC.Node
Node
EOC.Orion
Orion
Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Orion
Orion
EOC Filters
Resource
SWQL
Name
EOC.Interface
EOC.Node
EOC.Orion
Orion
1414
EOC.Interface
EOC.Node
EOC.Orion
Orion
EOC.Interface
EOC.Node
Node
EOC.Orion
Orion
EOC.Interface
EOC.Node
EOC.Orion
Orion
EOC.Interface
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
EOC.Orion
Orion
EOC.Volume.Stats VS
1415
IP SLA Filters
IP SLA Filters
Resource
SWQL Name
EOC.AlertStatus
AlertStatus
EOC.AlertDefinition
AlertDefinition
EOC.IpSla.Operation
IpSlaOperation
EOC.IpSla.OperationType
IpSlaOperationType
EOC.Orion
Orion
EOC.AlertStatus
AlertStatus
EOC.AlertDefinition
AlertDefinition
EOC.IpSla.Operation
IpSlaOperation
EOC.IpSla.OperationStatus ipSlaOperationStatus
EOC.IpSla.OperationType
IpSlaOperationType
EOC.IpSla.Site
SourceSite
EOC.IpSla.Site
TargetSite
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
N1
EOC.Node
N2
EOC.Orion
EOC.Voip.Link
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
EOC.Node
N1
EOC.Node
N2
EOC.Orion
EOC.Voip.Link
1416
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
EOC.Node
N1
EOC.Node
N2
EOC.Orion
EOC.Voip.Link
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
EOC.Node
N1
EOC.Node
N2
EOC.Orion
EOC.Voip.Link
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
EOC.Node
EOC.Orion
EOC.Voip.CCMStatistic
EOC.Node
N1
EOC.Node
N2
EOC.Orion
EOC.Voip.Link
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
1417
NCM Filters
EOC.Orion
EOC.Voip.Engine
EOC.Node
N1
EOC.Node
N2
EOC.Orion
EOC.Voip.Link
EOC.Voip.Site
S1
EOC.Voip.Site
S2
EOC.Voip.UdpResultDetail
NCM Filters
Resource
SWQL Name
Global Configuration
Manager Nodes
EOC.NCM.ConfigArchive
ConfigArchive
EOC.NCM.Nodes
NCMNode
EOC.Node
Node
EOC.Orion
Orion
EOC.NCM.ConfigArchive
ConfigArchive
EOC.NCM.Nodes
NCMNode
EOC.Node
Node
EOC.Orion
Orion
EOC.NCM.CacheDiffResults
CacheDiffResults
EOC.NCM.ComparisonCache ComparisonCache
EOC.NCM.Nodes
NCMNode
EOC.Node
Node
EOC.Orion
Orion
1418
SWQL Name
EventType
EOC.EventType
Event
EOC.Node
Node
EOC.Orion
Orion
EOC.Interface
EOC.NetFlow.Source S
EOC.Node
EOC.Orion
EOC.NetFlow.Engine S
EOC.Orion
Wireless Filters
Resource
SWQL
Name
EOC.Node
EOC.Orion
EOC.Wireless.Interface WI
Top XX Access Points by Number of
Clients
EOC.Node
EOC.Orion
EOC.Wireless.Interface WI
Top XX Wireless Clients by Traffic
Rate
EOC.Node
EOC.Orion
EOC.Wireless.Client
WC
1419
SWQL Name
EOC.Interface
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Orion
Orion
EOC.Interface
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Node.CustomProperty NodeCustomProperty
EOC.Orion
Orion
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Orion
Orion
EOC.Node
Node
EOC.Node.CustomProperty NodeCustomProperty
EOC.Orion
Orion
EOC.Node
1420
Orion Summary
Statistics
EOC.Orion
Orion
EOC.Volume
EOC.Orion
SysLog Filters
Resource
Orion
SysLog
Trap Filters
Resource
Orion
EOC.Trap
Trap
IVIM Filters
All Integrated Virtual Infrastructure Management (IVIM) resources use SWQL
filtering:
Virtualization Summary
Resource
SQL Table
Name
Orion.VIM.Hosts h
Orion.VIM.Hosts hosts
Orion.Nodes
Orion.Nodes
1421
SWQL
Name
Datacenter Details
Orion.VIM.Hosts h
Orion.Nodes
Orion.VIM.Hosts hosts
Orion.Nodes
nodes
Resource
SQL Table
Name
SWQL
Name
Orion.VIM.Hosts hosts
Orion.VIM.Hosts hosts
Datacenter Details
Orion.Nodes
Orion.Nodes
Top 10 VMware Hosts by CPU Load
nodes
nodes
Orion.VIM.Hosts hosts
Orion.Nodes
nodes
Orion.VIM.Hosts hosts
Orion.Nodes
nodes
Cluster Details
Resource
Orion.VIM.VirtualMachines vms
SWQL
Name
Orion.VIM.Hosts
hosts
Orion.Nodes
nodes
Orion.NodesStats
stats
Orion.VIM.VirtualMachines vms
Orion.VIM.Hosts
hosts
Orion.Nodes
1422
Orion.VIM.VirtualMachines vms
Orion.VIM.Hosts
hosts
Orion.Nodes
Orion.VIM.VirtualMachines VM
Orion.VIM.Hosts
Orion.Nodes
Table Name
SWQL Alias
All Applications
Tree
Orion.APM.Application
Application
Orion.APM.ApplicationTemplate
ApplicationTemplate
Orion.APM.CurrentApplicationStatus Status
Orion.Nodes
Nodes
Application
Template
Orion.APM.CurrentApplicationStatus Status
Top XX
Components by
Statistic Data
Orion.Nodes
Nodes
APM_CurrentComponentStatus
MonitorStatus
APM_PortEvidence
pe
1423
Top XX
Components by
Response Time
Top XX
Processes by
CPU Load
Top XX
Processes by
Physical
Memory
Top XX
Processes by
APM_ComponentExt
Monitor
APM_Application
Application
APM_CurrentApplicationStatus
ApplicationStatus
APM_ThresholdsByComponent
thresholdRT
APM_ThresholdsByComponent
thresholdStat
APM_ErrorCode
ec
APM_StatusCodeType
sct
APM_StatusCode
sc
APM_CurrentComponentStatus
MonitorStatus
APM_PortEvidence
pe
APM_ComponentExt
Monitor
APM_Application
Application
APM_CurrentApplicationStatus
ApplicationStatus
APM_ThresholdsByComponent
Threshold
APM_CurrentComponentStatus
MonitorStatus
APM_PortEvidence
pe
APM_ComponentExt
Monitor
APM_Application
Application
APM_CurrentApplicationStatus
ApplicationStatus
APM_CurrentComponentStatus
MonitorStatus
APM_PortEvidence
pe
APM_ComponentExt
Monitor
APM_Application
Application
APM_CurrentApplicationStatus
ApplicationStatus
APM_ThresholdsByComponent
Threshold
APM_CurrentComponentStatus
MonitorStatus
APM_PortEvidence
pe
1424
Virtual Memory
APM_ComponentExt
Monitor
APM_Application
Application
APM_CurrentApplicationStatus
ApplicationStatus
APM_ThresholdsByComponent
Threshold
1425
JMX
JMX is an acronym for Java Management Extensions and allows remote clients
to connect to a Java Virtual Machine (JVM).
Using JMX, you can manage and monitor running applications in a JVM
environment. Using Java, management of applications in a virtual machine is
done through the use of Managed Beans, or MBeans.
MBeans are the soul of JMX. MBeans are the controllable end-points of an
application where remote clients can watch application activity as well as control
them. The MBean represents a resource running in the JVM, such as an
application. They can be used for collecting statistics like performance, resource
usage, problems, and so on.
To monitor a Java Virtual Machine through JMX, add the following argument into
the java command that publishes the platform MBean server to your local
environment for monitoring.
Dcom.sun.management.jmxremote
1426
JConsole
A common tool used to monitor a JVM is JConsole. JConsole is a free graphical
monitoring tool used to monitor JVMs.
JConsole is not necessary to use the JMX component monitor within SAM. The
information provided here concerning JConsole is an introduction to using Java
as a means of monitoring. Detailed information on how to use JConsole can be
found by navigating to the following link:
http://www.sysads.co.uk/2014/01/installing-jconsole-windows/
Once you have downloaded and installed JConsole, you can run it by navigating
to the folder where it was installed. Typically, the JConsole.exe is located at:
C:\Program Files\Java\jdk1.7.0_02\bin\JConsole.exe.
Double-click JConsole.exe to start the program. Following is a screenshot of
JConsole running, before being logged in:
1427
To login to JConsole:
To login to JConsole:
1.
2.
3.
4.
Select either the Local Process option or the Remote Process option.
Highlight your option by clicking on it.
Complete the credential fields (Username & Password).
Click Connect.
After you are successfully logged in, click on the tab entitled MBeans. Clicking the
MBeans tab brings you to this screen:
From here, you can drill down to any MBean you want by expanding the folder
tree in the left pane of the window. Select any MBean (file in the tree) to have
information about it displayed in the right pane. These MBeans are what
SolarWinds SAM uses when polling information from the JVM.
1428
1429
1430
8. Expand the folders by clicking the arrows (or [+]) to expand the tree-view
folder structure. From here you can drill down to select the attributes you
want by checking them.
9. Click Next.
Now you are able to edit the JMX Component Monitor properties. Following is an
illustration of how polled MBeans will look when successfully added and
implemented within SAM:
1431
1432
l
l
Java Arguments
For enabling remote JMX monitoring, the following Java arguments will be used:
-Djava.rmi.server.hostname=192.168.0.236
This line indicates the IP address the RMI server will use. Type your server IP
address here.
-Dcom.sun.management.jmxremote
This line indicates which port the JMX module will use to accept JMX
connections.
-Dcom.sun.management.jmxremote.ssl=false
This line indicates where the passwords file is stored. Do not add this line if you
are not using authentication.
-Dcom.sun.management.jmxremote.access.file=c:\jmxremote.access
This line indicates where the access file is stored. Do not add this line if you are
not using authentication.
More information can be found at the following website:
http://docs.oracle.com/javase/1.5.0/docs/guide/management/agent.html.
Configuring a Standalone Java Virtual Machine
Windows:
1. Download the JDK from the Oracle website:
http://www.oracle.com/technetwork/java/javase/downloads/index.html
1433
2.
3.
4.
5.
6.
7.
For example:
Variable name: JAVA_HOME
Variable value: C:\Program Files\Java\jdk1.7.0_3
Note: If you want to run Java commands from the command line, you should add
the JDK installation path to the PATH variable.
If you plan to use JMX authentication, follow steps 8-12:
8. Navigate to the %JAVA_HOME%\jre\lib\management folder.
9. Rename the jmxremote.password.templatefile to
jmxremote.password. Edit jmxremote.password by replacing/adding its
content with the following: samuser somepasswd
where samuser is the user for the JVM monitored from SAM and
somepasswd is the password.
10. Edit jmxremote.access by replacing/adding its content with the following:
samuser readonly
where samuser is user for the JVM monitored and readonly gives this read
only permissions.
11. Copy jmxremote.access and jmxremote.password to a folder, for
example c:\jmxremote\.
12. Grant access to the jmxremote.password file only for the Administrator. To
grant access only for the Administrator, refer to this topic at the following
location:
http://download.oracle.com/javase/6/docs/technotes/guides/management/se
curity-windows.html
Linux:
1434
automatically set at boot time. To set the path immediately, use the following
command: $ export PATH=$PATH:/usr/local/java/bin
7. Add a variable to the system with the path pointing to the JDK installation
folder.
8. Add the following lines to the /etc/profile file. Syntax dependencies
may be different in various Linux distributions. This example is shown for
the CentOS system:
export JAVA_HOME=/usr/java/jdk1.7.0_3
export PATH=$PATH:/usr/java/jdk1.7.0_3
To set this immediately, run the export commands in your shell, or, logout then log
back in to your system.
If you use JMX authentication follow the steps 9-13.
9. Go to the $JAVA_HOME/jre/lib/management folder and rename the
jmxremote.password.template file to jmxremote.password.
10. Edit jmxremote.password by replacing/adding its content with the
following:
samuser somepasswd
where samuser is the user for the JVM monitored from SAM and
somepasswd is the password.
11. Edit jmxremote.access by replacing/adding its content with the following:
samuser readonly
1435
For example:
java -Dcom.sun.management.jmxremote Dcom.sun.management.jmxremote.port=8686 Dcom.sun.management.jmxremote.ssl=false Dcom.sun.management.jmxremote.authenticate=true Dcom.sun.management.jmxremote.password.file="c:\jmxremote\jmxre
mote.password" Dcom.sun.management.jmxremote.access.file="c:\jmxremote\jmxremo
te.access"some_java_applet
In a separate window/shell, run the following command to test JMX and the JDK
configurations:
%JAVA_HOME%\jdk1.7.0_3\bin\jconsole
1436
1437
===============================================================
======
2. Start JBoss by running %JBOSS_HOME%\bin\run.bat.
Linux:
1. Edit $JBOSS_HOME/bin/run.sh by adding the following lines (where
$JBOSS_HOME$ is the path to your JBoss installation):
JAVA_OPTS="$JAVA_OPTS Djavax.management.builder.initial=org.jboss.system.server.j
mx.MBeanServerBuilderImpl"
JAVA_OPTS="$JAVA_OPTS -Djboss.platform.mbeanserver"
JAVA_OPTS="$JAVA_OPTS Djava.rmi.server.hostname=192.168.0.236"
JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.port=8686"
JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.ssl=false"
JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.authenticate=true"
JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.password.file="
/jmxremote/jmxremote.password""
JAVA_OPTS="$JAVA_OPTS Dcom.sun.management.jmxremote.access.file=/jmxremote/jmxrem
ote.access""
where 192.168.0.236 is the IP address of JBoss server.
1438
1439
10.
11.
12.
13.
Click OK.
Click, Save and then click OK.
Click Save.
Restart the IBM WebSphere Application Server.
If you have errors after these configuration changes, you can manually
change/restore the configuration. These changes are stored in the following file:
%WEBSPHERE_HOME%\profiles\your_profile\config\cells\your_
cell\nodes\your_node\servers\your_server\server.xml
1440
call "%DOMAIN_HOME%\bin\setDomainEnv.cmd" %*
set "JAVA_OPTIONS=%JAVA_OPTIONS% Djavax.management.builder.initial=weblogic.management.jmx.mbean
server.WLSMBeanServerBuilder"
set "JAVA_OPTIONS=%JAVA_OPTIONS% -Dcom.sun.management.jmxremote"
set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.jmxremote.port=8686"
set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.jmxremote.ssl=false"
set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.jmxremote.authenticate=true"
set "JAVA_OPTIONS=%JAVA_OPTIONS% Dcom.sun.management.jmxremote.password.file="
1441
Warning: This file is created by the Configuration Wizard. Your changes to this
script will be lost the next time you use the configuration wizard.
2. Restart the WebLogic Server.
Linux:
1. Edit the following file:
$MIDDLEWARE_HOME/user_projects/domains/<your_
domain>/bin/startWebLogic.sh
where $MIDDLEWARE_HOME is the path to your WebLogic installation, by
. ${DOMAIN_HOME}/bin/setDomainEnv.sh $*
JAVA_OPTIONS="$JAVA_OPTIONS-
1442
Warning: This file is created by the Configuration Wizard. Your changes to this
script will be lost the next time you use the configuration wizard.
2. Restart the WebLogic Server.
Java Application Server (JMX)
This template assesses the overall performance of Java Application Servers by
using JMX protocol. The following application servers are supported: Apache
Tomcat, JBoss, GlassFish, IBM WebSphere andOracle WebLogic.
Prerequisites: Target JVM configured to allow JMX queries.
Note: This template is configured to send JMX requests on port 8686.
Credentials: Dependent on the JMX configuration.
Note: All monitoring information is taken from:
http://docs.oracle.com/javase/1.5.0/docs/guide/management/overview.html.
Monitored Components
Note: All components may vary from a running environment. You can add your
own threshold limits as necessary. For more information, see
http://knowledgebase.solarwinds.com/kb/questions/2415.
Classes Loaded Count
1443
1444
1445
1446
1447
1448
/usr/local/java.
Add the /usr/local/java/bin
8. Add a variable to the system with the path pointing to the JDK installation
folder.
9. Add the following lines to the /etc/profile file. Syntax dependencies may be
different in various Linux distributions. This example is shown for the
1449
In another window/shell, run the following command to test SNMP and the JDK
configurations:
snmpwalk -v 2c -c public 127.0.0.1:1161
1.3.6.1.4.1.42.2.145.3.163.1.1.2.11
1450
3.
4.
5.
6.
7.
8.
Click Apply.
Go to the Windows Services console.
Right-click the Apache Tomcat service.
Click Properties.
Click the Log On tab, and then select Log on as this account.
Click Browse, find the user Administrator and type the Administrator password twice.
9. Click OK.
10. In the Tomcat Configuration window, return to the General tab, and then
start the service.
Windows Command Line
1. Open the file %TOMCAT_HOME%\bin\catalina.bat and add the following
lines into the Debug, Run and Start sections (where %TOMCAT_HOME%
is the path to your Tomcat installation):
set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.port=1161"
set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.interface=0.0.0.0"
:doDebug
set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.port=1161"
set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.interface=0.0.0.0"
shift
:doRun
set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.port=1161"
set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.snmp.interface=0.0.0.0"
shift
1451
1452
3.
4.
5.
6.
7.
1453
14.
15.
16.
17.
18.
19.
20.
21.
Click OK.
Click, Save and then click OK.
Click Save.
Go to the Windows Services console.
Right click the IBM Websphere service.
Click Properties.
Click the Log On tab and then select Log on as this account.
Click Browse, find the user Administrator, and then type the Administrator password twice.
22. Click OK.
23. Restart the IBM WebSphere Application Server.
For more information, see "JMX" on page 1426.
Configuring Oracle WebLogic (tested on version 10.3.4.0)
Windows
Oracle WebLogic uses its own JDK installed in %MIDDLEWARE_HOME%\jdk*
(where %MIDDLEWARE_HOME% is the path to your WebLogic installation).
1. Go to the $JAVA_HOME/jre/lib/management folder
2. Rename the snmp.acl.template file to snmp.acl.
3. Edit snmp.acl by replacing its content with the following:
acl = {
{
1455
call "%DOMAIN_HOME%\bin\setDomainEnv.cmd" %*
set "JAVA_OPTIONS=%JAVA_OPTIONS% -Dcom.sun.management.snmp.port=1161"
set "JAVA_OPTIONS=%JAVA_OPTIONS% -Dcom.sun.management.snmp.interface=0.0.0.0"
set SAVE_JAVA_OPTIONS=%JAVA_OPTIONS%
1456
1457
acl = {
{
communities = public, private
access = read-only
managers = localhost, apm-server
}
}
Where apm-server is the hostname of your APM server (Note: It is better to use
IP addresses).
4. Grant access to the snmp.acl file only for the root user. Run the following
commands as the root user in your shell:
# chown root.root $JROCKIT_HOME/jre/lib/management/snmp.acl
# chmod 600 $JROCKIT_HOME/jre/lib/management/snmp.acl
5. Edit the following file if you want to enable SNMP on a WebLogic server
instance:
$MIDDLEWARE_HOME/user_projects/domains/<your_
domain>/bin/startWebLogic.sh
1458
. ${DOMAIN_HOME}/bin/setDomainEnv.sh $*
JAVA_OPTIONS="$JAVA_OPTIONS -Xmanagement:"
JAVA_OPTIONS="$JAVA_OPTIONS -Dcom.sun.management.snmp.port=1161"
JAVA_OPTIONS="$JAVA_OPTIONS Dcom.sun.management.snmp.interface=0.0.0.0"
SAVE_JAVA_OPTIONS="${JAVA_OPTIONS}"
Note: As an alternative you can add these lines into the following:
$MIDDLEWARE_HOME/user_projects/domains/<your_
domain>/bin/startManagedWebLogic.sh
MAPI
Messaging Application Programming Interface (MAPI) is a Microsoft Windows
program that enables you to send email from within a program. Programs that use
MAPI include word processors, spreadsheets, and graphics applications.
Programmers who are using Microsoft's Active Server Page (ASP) technology
access MAPI by using Microsoft's Collaboration Data Objects (CDO). The CDO
library comes with Microsoft's Internet Information Server (IIS). MAPI functions can
be accessed by Visual Basic programmers.
CDO - http://www.microsoft.com/download/en/details.aspx?id=1004
A "session" is a specific connection between the client and the MAPI program.
MAPI defines the following three services:
l
l
l
1459
This component monitor does not compute a statistic. The response time is the
difference between the time SolarWinds SAM sends the email and the time that it
is received by the recipient. Following is an illustration of the MAPI monitor. To
1460
1. This component monitor waits for the email to arrive based on the default
job timeout of 20 minutes. If the email does not arrive within this period,
SolarWinds SAM marks the monitor as Down.
2. The monitor goes through the following steps with respect to the mail flow:
a. Sends an email to the user mailbox via SMTP. The email has a
unique temporary subject name that starts with APM_prefix.
b. Connects to the user mailbox through MAPI, then searches the
emails by Subject.
c. If it does not find the email it is looking for, it waits and then
searches again. It will stop when:
1. It finds the email;
1461
Enable Component
Determines whether the component is enabled.
Credential for Monitoring
Select a credential that is both a user who can log on to the SolarWinds
SAM server, and that has an Exchange account on the MAPI server. If the
credential you need is not already present in the credentials list, use the
Quick Credentials section to add a new credential.
Send Email From
This field allows you to specify the From address of the test email message.
Send Email To
This field allows you to specify the recipient of the test email message. The
recipient should have a mailbox on the MAPI server you are monitoring.
MAPI Profile Name
Allows you to specify the name of the MAPI profile
1462
Troubleshooting MAPI
The following procedures will help you troubleshoot MAPI issues relating to SAM:
Note: Do not use the same mailbox for multiple MAPI UX monitors. Doing so can
cause the MAPI monitor to intermittently fail.
1463
l
l
The Orion Server is in the same domain as the Exchange server being monitored
The user account used to monitor the mailbox with SAM has permission to
login to the server console and has done so at least once.
The user account to monitor the mailbox with SAM is in the local administrator user group of the server where SAM is installed
MAPI component is using the FQDN for the domain account.
The MAPI profile does not need to exist. The probe should create it and also
update the existing profile with the required settings. However, there may be
issues with an existing or created profile. The default Outlook profile is
called Outlook.
If this profile does not work, create a profile with the MFCMapi free tool,
availabe at: http://mfcmapi.codeplex.com/.
l In the MFCMapi tool, navigate to Profile > Advanced Profile >
Launch Profile Wizard, keeping the defaults on the first dialog.
l Set the profile as default.
l Update the profile name of the newly created profile in the MAPI
probe.
Use MFCMapi to find the profile name: Navigate to Profile > Show Profiles for verification.
Check that Send Email To: is correctly filled out in the component settings.
The Mapi Profile Name must match the actual profile name. Use the
MFCMapi tool if you are not sure about the name.
Credentials used for the probe must be eligible to open the mailbox. It is
required to add the user to the local Administrators group, otherwise the
probe can fail with insufficient privileges.
1464
Advanced Troubleshooting
SolarWinds.APM.MAPI.exe Command Line Arguments
To analyze issues with the MAPI probe more closely, run the MAPI executable
from the command line. The following arguments can be used:
Command
Explanation
-s <subject>
-server
<server_
name>
-t
<timeout>
-p <profile_
name>
-u <user_
name>
-attempts
<count>
-debug
-removeall
-w
1465
In SAM v5.0+:
In SAM v5.0+:
-subjectmatchsubstring: This enables a substring subject match. The target
mail subject is expected to match the substring of the subject setting. An exact
match is expected by default. This is useful for matching emails returned by
bouncers, which can add Re: to the mail subject.
Note: This command is not listed in the configuration file.
For example:
SolarWinds.APM.MAPI.exe -debug -s "test subject" -u domain\user.name server exchange -p Outlook -t 10000
Important: Run the executable as the user owning the mailbox. To do this, start a
new cmd.exe and run the following command.
runas /user:domain\user.name cmd.exe
This will ask for a password and start a new cmd.exe with that user account. Test
the MAPI executable from this console.
The MAPI probe is also configurable via the SolarWinds.APM.MAPI.exe.xml file.
Settings in this file take precedence over any command line arguments. See the
following:
<settings> <!-- c:\logs will not be made by this program, it must exist to
enable logging --> <logdirectory>c:\logs</logdirectory> <logenable>false</logenable> <logkeepall>true</logkeepall> <enablewatchdog>true</enablewatchdog>
<mapimaxwaitlogoff>2500</mapimaxwaitlogoff> <dologoff>true</dologoff>
<!-- <debug>false</debug> <removeall>true</removeall> <subjectpattern>^APM_MAPITestEmail__GUID:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9afA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$</subjectpattern> <delaybetweenattempts>500</delaybetweenattempts> --></settings>
Command
Explanation
Logdirectory
1466
Logenable
Logkeepall
Enablewatchdog
Mapimaxwaitlogoff
Dologoff
Debug
Removeall
Subjectpattern
1467
Oracle
Oracle
This section is designed to give you a basic introduction to the Oracle database
model and its use with SolarWinds SAM. For more detailed information on
Oracle, seek resources outside of this guide.
Storage
The Oracle RDBMS stores data in the form of tablespaces and physically in the
form of ("datafiles"). Tablespaces can contain various types of memory segments,
such as Data Segments, Index Segments, etc. Segments are made up of one or
more extents. Extents make up groups of continuous data blocks. Data blocks are
the basic units of data storage.
Newer versions of the database include a partitioning feature, which allows tables
to be partitioned based on different sets of keys.
Oracle tracks its data storage using the information stored in the System
tablespace. The System tablespace contains the data dictionary, indexes and
clusters. A data dictionary consists of a collection of tables that has information
about all user objects. Beginning with version 8i, the Oracle RDBMS also
supports locally managed tablespaces which can store space management
information in their own headers rather than in the System tablespace.
Disk files
Disk files primarily consist of the following types:
l
Data and index files: These files are necessary for the physical storage,
which can be made up of the data dictionary, user data, or index data.
1468
l
l
Credentials: An Oracle user name and password with read access to the Oracle
views: dba_free_space, v$sysstat, v$rowcache, v$librarycache, v$sgastat,
and v$session.
Note: Some required settings information will be needed. See Getting the
Required Settings, on page 22.
Installing ODP.Net
The following instructions describe the recommended method for monitoring
Oracle databases using ODP. Net.
1469
Installing ODP.Net
Uninstall any other version of the Oracle Client before proceeding. Ensure that
SolarWinds Basic Lite Oracle Client is not installed. Verify that the following
directory does not exisit or is empty: C:\Program Files (x86)
\Solarwinds\Orion\APM\OracleClient\. If it is not empty, stop all Orion services
and remove this directory before you continue with your installation.
Note: ODP. Net is not part of SolarWinds SAM and may need to be downloaded
from the Oracle website, which requires free registration. Download the 32-bit
version of ODP.Net, even if SAM is installed on a 64-bit version of Windows.
1. You can use the following link to download ODP.Net:
l http://www.oracle.com/technetwork/topics/dotnet/index-085163.html
If you do not want to register with Oracle, you can use the Basic Lite Client
which can be downloaded by logging in to your SolarWinds customer
portal. Location and installation instructions can be found at, "Installing the
Basic Lite Oracle Client" on page 1475. Following is a screenshot of
Oracle's website with the both the 32 and 64-bit versions highlighted.
Download the 32-bit version.
Note: You can download the 64-bit version. Installing this version will
require you to poll jobs using the 64-bit option within SAM.
1470
2. Next, download ODAC with Oracle Developer Tools for Visual Studio, as
shown below. This installation package comes with its own installer:
1471
Installing ODP.Net
3. Accept the License Agreement and then select the latest version when
prompted. You will be asked for your Oracle Username and Password. If
you have not already done so, register for free with Oracle to obtain these
needed credentials.
1472
1473
Installing ODP.Net
l
l
10. When the installation finishes successfully, click Exit. Restart all Orion services by navigating to: Start > SolarWinds Orion > Orion Service Manager.
Note: Restarting of the services is necessary because the Oracle
1474
1475
4. Copy the downloaded file to the SAM computer and extract OracleClientInstaller.exe from the zip archive.
1476
After the installer window closes, navigate to the SAM installation directory,
typically: C:\Program Files\SolarWinds\Orion, and ensure that the subfolder,
APM\OracleClient was created successfully and contains the five files as shown
below:
Check the file properties of each .dll file to ensure that the account under which
the SolarWinds JobEngine v2 service runs has high enough privileges to load
1477
Restart all Orion services by navigating to Start > SolarWinds Orion > Orion
Service Manager.
Note: Restarting of the services is necessary because the Oracle installer added
its installation directory (c:\app\Administrator\... by default) to the Path variable.
From the Service Manager, click Shutdown Everything.
When all services are stopped, click Start Everything and wait for the services to
begin.
1478
4. At the Add Application Monitors step, select the Oracle Database Template.
Do not test it. At this stage the application template requires further configuration which cannot be done from this page. Testing at this point will res-
1479
5. Go to the last step of the wizard and click OK, ADD NODE.
6. You will be redirected to the Manage Nodes page. Search for the newly
added Oracle server and click on it to go to its Node Details view.
7. Search for the Applications resource on this view and click on the Oracle
Application to go to its Application Details View.
1480
1481
1482
1483
Microsoft .NET
Oracle Data Provider
Data Provider
for .NET (ODP.NET)
(MS_
ORACLECLIENT)
Works
Works
Works
1484
2. Search for the Oracle Database Template, select it by checking the box
next to the name.
3. Click Assign to Node.
1485
1486
11. Expand each monitor by clicking [+]to the left of each component monitor
in the list.
1487
12. The correct settings for the fields Destination Point Type and Destination
Point Name (highlighted above) should be provided by the administrator
1488
13. Repeat steps 11-12 for each monitor in this template. Use the following
table for reference:
Oracle Driver Type setting in Web UI
Oracle Client package
Microsoft .NET
Oracle Data Provider for
Data Provider
.NET (ODP.NET)
(MS_
ORACLECLIENT)
Works
Works
1489
3. Once you have located this file, open the file and follow these steps to
extract the required information.
a. Locate the section in the file that describes the options for the database
instance you want to monitor. For the most part, this section will contain
the settings for Protocol, Host, and Port as shown in the examples bulleted below.
b. Once you locate this section, extract the following settings and use
them in the Oracle User Experience Monitor:
l Protocol Must be TCP. This how SAM connects to the remote
Oracle Server.
l Host Must match the IP address (or hostname, which resolves
to that IP) of the Oracle server node in SAM.
l Port Use this setting for the Port Number field of Oracle User
Experience Monitor.
l Service_Name If this is present in the tnsnames.ora configuration section, then select the value for the Service_Name for
the Destination Point Type field of the Oracle User Experience
Monitor.
l SID If this is present in the tnsnames.ora configuration section, then select the SID value for for the the Destination Point
Type field of the Oracle User Experience Monitor.
1490
Example 1: Following is a sample tnsnames.ora file from the Oracle Server 10g
Express Edition. Highlighted are the settings mentioned previously.
Example 2:
1491
Troubleshooting
Here is what the configuration of the Oracle User Experience Monitor should look
like when completed correctly using Example 1:
Troubleshooting
If the Oracle User Experience Monitor does not work properly, explore the
following troubleshooting sections.
l
l
l
l
l
1492
Oracle Client drivers are not forward and backwards compatible with all
Oracle database servers.
Oracle Data Provider for .NET (ODP.NET) 11.2.0.3.0 is compatible only
with Oracle Server 9.2 and higher.
Monitoring two different versions of Oracle Server might not be possible if there is
no appropriate driver which would be able to connect to both server versions. If
this is the case, have the second version of the Oracle Client on an additional
poller and assign the nodes there.
SAM is Unable to Load the Oracle Client Driver
Following is a screenshot of this error:
1493
Troubleshooting Steps:
Troubleshooting Steps:
l
Make sure that the Oracle Client was installed on the SAM computer or on
the appropriate additional poller.
Do not deploy two different Oracle Client Driver versions on the SAM computer.
If the above was unsuccessful, follow these troubleshooting steps:
The example below shows ORACLE_HOME set to the APM\OracleClient directory. This computer has the Basic Light Oracle Client installed
(not the full ODP.NET version).
1494
1495
Using Process Explorer to Determine if SAM is Loading the Correct Oracle Client
1496
1497
4.
5.
6.
7.
Click OK.
Restart the JobEngine v2 service and wait for it to fully restart.
Go to the Oracle Database Edit page and test one of the components.
Wait until the test is finished and then stop the trace (File > Capture
Events).
8. Analyze the results. There will be information about SWJobEngineWorker2.exe trying to find the oci.dll file, (which is part of the Oracle Client),
revealing a list of directories it was searching for and whether or not it was
successful. The Load Image event indicates whether or not SAM was able
to load that library successfully. This may fail if the architecture of this library does not match the architecture of the polling job (as defined on the
Application Edit page in SAM).
1498
Below is sample output when the Oracle Client is not installed and therefore not
found:
Here you can see which directories are being searched to locate the file. Below
you can see that the full Oracle Client was installed:
1499
Here you can see SAM was not able to load the Oracle Client because it does not
match the platform of the polling job. In this case, the Oracle Database application
is set to run as 64-bit, but the 32-bit version of the Oracle Client was installed. You
can also see that SAM finds the oci.dll and opens it to read from it, but it detects
that this is the wrong platform. Consequently, there is no Image Load operation:
1500
Troubleshooting steps:
1. Make sure a firewall is not blocking communication between SAM and
Oracle computers.
2. Verify the configuration of the Oracle User Experience Monitor.
1501
l
l
The Oracle SQL*Plus tool is included in the Oracle Data Provider for .NET
(ODP.NET) package. This package should be installed first as described in the,
Installing ODP.Net, section. Once installed, navigate to the installation directory
and ensure that the sqlplus.exe file exists.
1502
l
l
For example:
sqlplus SYSTEM/Password1@10.199.1.219/XE
This is used to connect to the XE instance on the Oracle Server running on
10.199.2.219 under the System account using Password1 as the password.
l
SqlPlus will show information on whether or not the connection was successful. If the connection was unsuccessful, the error message should contain the reason why it failed.
If the connection was successfully established, then the prompt, SQL>, is
shown.
1503
l
l
<Password> is the valid password for this account as defined in the SAM
Credential Library.
<OracleServerNameOrIP> is the Oracle Server hostname or IP address.
<PortNumber> is the specified TCP port where the Oracle endpoint
listens.
<EndPointType> specifies the type of Oracle endpoint. This value must
be either Service_Name or SID. This should match the Oracle User Experience Monitor settings in SAM.
<ServiceNameOrSid> is the Oracle endpoint Service_Name or SID value
as defined in the Oracle User Experience Monitor settings.
For Example:
sqlplus SYSTEM/Password1@(DESCRIPTION=(ADDRESS_LIST=
(ADDRESS=(PROTOCOL=TCP)(HOST=10.199.1.219)(PORT=1521)))
(CONNECT_DATA=(SERVICE_NAME=XE)))
Note: This example is used without specifying the password on the command line (Sqlplus will prompt for a password.)sqlplus SYSTEM @
(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)
(HOST=10.199.1.219)(PORT=1521)))(CONNECT_DATA=(SERVICE_
NAME=XE)))
See the following illustration:
1504
Using SQL*Plus to connect using this method must be tried if SAM is unable to
connect to the Oracle Server. If the connection does not work from SQL*Plus, then
it will not work from SAM.
Executing queries using SQL*Plus
1. Connect to the Oracle Server as described in previous sections. Ensure
SQL*Plus shows the SQL> prompt.
1505
If this query is successful, the next step is to try the same query as used in the
Oracle User Experience Monitor in SAM.
3. Type the SQL query used by the Oracle User Experience Monitor and put
a semicolon at the end. Note: Semicolons are required in SQL*Plus.
4. Press Enter to run the query.
This query may fail if you do not have privileges to access these SQL tables or
views. If this is the case, you should connect to the Oracle Server using the
Oracle administrator account (System) and execute the query under this account.
If this works, then the issue is permissions related and needs to be changed or a
different account should be used in SAM for monitoring.
1506
PowerShell
The ability to employ PowerShell scripts within SAM is a powerful advantage for
system administrators. This document merely provides an introduction to
PowerShell, as well as its role with SAM.
Windows PowerShell is a command-line shell created for system administrators.
PowerShell includes an interactive prompt and a scripting environment that can
be used independently or in combination.
PowerShell is built on top of the .NET Framework Common Language Runtime
(CLR) and the .NET Framework, and accepts and returns .NET Framework
objects.
PowerShell also introduces the cmdlet. A cmdlet is a simple command that can
manipulate objects in PowerShell. Cmdlets have a unique format -- a verb and
noun separated by a dash (-), such as Get-Help. You can use each cmdlet
separately or in combination to perform complex tasks. PowerShell includes more
than one hundred cmdlets, and you can write your own.
PowerShell gives you access to the file system on the computer. In addition,
PowerShell providers enable you to access other data stores, such as the
registry, for example.
Things you should know about PowerShell:
l
1507
1508
3. Download the Exchange Server 2010 SP1 installation files and extract
them to a temporary folder on your computer.
4. From that folder launch Setup.exe. (If your computer is missing the .NET
Framework, visit Microsoft.com to download and install it. Additionally,
Steps 1 and 2 of the Exchange Server 2010 SP1 installation will prompt
you to install pre-requisites if they are missing, as shown in the following
1509
5. If needed, install the pre-requisites for Exchange Server 2010 SP1. If not,
click on Step 3 from the install screen and choose Install only languages
from the DVD.
1510
1511
1512
If SAM is installed on a 32-bit server and polling a 64-bit machine, you may
encounter some errors. You should install SAM on a 64-bit server if you
need to poll 64-bit machines.
Note: There may be instances where installed software on a 64-bit machine may
have added its own cmdlets into the 32-bit version of PowerShell. If this is the
case, you should use 32-bit polling.
On Windows machines, you can determine the platform you are using by rightclicking My Computer and clicking Properties.
Troubleshooting PowerShell Snap-In Compatibility
The most common issue with PowerShell is the incompatibility of the snap-ins
with the platform of PowerShell being used; meaning both PowerShell and its
snap-ins should both be either 64-bit or 32-bit. When running your script in SAM,
typical errors of this type resemble the following:
In order to diagnose and correct this problem, verify that the snap-ins are properly
registered by doing the following.
1. Find the following registry path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\1\PowerShellSnapIns
1513
2. Open PowerShell though the GUI and check to see if the process is running in 32-bit mode. This is denoted by the *32 next to the process name.
Since this is a 64-bit server with the 64-bit Exchange Management
installed, PowerShell should not have a "*32" next to the process name. It
should look similar to the image below:
5. Now you should be able to execute a PowerShell command such as GetMailboxDatabase -Server {exchange server hostname} and have it return
1514
6. Your snap-in module has properly been registered. SAM templates that
use PowerShell will now work properly.
In this example, the Exchange 2007-2010 Mailbox Send and Receive Statistics
with PowerShelltemplate is used. This template tracks Exchange Mailbox
Send/Receive statistics of Exchange 2007-2010 servers with the Mailbox role
using PowerShell scripts.
The following screen appears once you have selected a template to edit,
revealing the individual component monitors as well as details about the
template:
1515
l
l
Credentials:
The credentials must be an Exchange Administrator (Organization Manager)
account with at least view-only permissions.
Note: Before using this template, under the Advanced tree collapse [+], you
should set the correct platform; either 32-bit or 64-bit, from the drop down menu.
The default it set to 32-bit.
1516
The following details about the selected component monitor are revealed:
1517
Using a PowerShell script, the monitor in this example is designed to return the
number of items received by a specific user during the last month.
In order to use this monitor, you will need to change the Script Arguments field
from the default example of, user@domain.sw,server.domain.sw to something
that will suit your needs for your particular environment. You can do this by
clicking the Edit button (highlighted above).You also have the ability to alter the
pre-defined script that comes with PowerShell component monitors.
Note: Unless otherwise directed by the documentation, you should not need to
edit pre-defined scripts.
Once you have changed the Script Arguments field, click Submit to begin using
the component monitor within the template. The output for this script using the
1518
The output for the script using only PowerShell should be similar to the following
illustration:
1519
Variables are used for storing information. In SAM, variables are prefixed with "$",
as highlighted below. The following code snippet from the above code calculates
a numerical value and then stores it in the variable $stat. In the illustration below,
the variable's value is reported as 9356, as highlighted in the Statistic column's
output.
Text and variables within quotes indicate information that may be visible to the
user. When made visible, the variables in the message will be replaced with the
values the variables store. The variables are highlighted below in both the code
and the output:
1520
With these same lines of code, Message: and Statistic: refer to the columns
where the information will be placed:
Meaning
Up
Down
Warning
Critical
1521
The two exit codes in this example are conditional, meaning either one or the
other will be triggered based on a certain outcome. When Exit 0; (status of Up) is
reported, the message and statistic are displayed and the monitor shows a status
of Up. When Exit 1; (status of Down) is reported, the message and statistic are
not displayed and a status of Down is reported.
If you want to inform SolarWinds SAM that a PowerShell script reports an Up
status, you would exit the script using Exit 0;
Scripts with Text Output
Scripts report additional details by sending text to the scripts standard output.
SAM supports multiple values returned by a script using the following format.
There is a limit of 10 Statistic and Message pairs for the script. These can be
placed anywhere in the script output. The Statistic and Message names you
give must contain valid letters and/or numbers.
Detail Type
Required Meaning
Statistic
Yes
Message
No
1522
1523
For x64, navigate to Start > Accessories > Windows PowerShell > Windows PowerShell
For x86, navigate to: Start > Accessories > Windows PowerShell > Windows PowerShell (x86)
1524
Note: The steps outlined below are only for advanced users. Following the steps
outlined in the section, " PowerShell 2.0 Remoting Configuration" on page 1527
should be sufficient for most users and environments.
Aside from new remoting specific cmdlets with enhanced capabilities,
PowerShell 2.0 also ships with full remoting functionality. It is possible to connect
your local PowerShell session to a remote computer and execute commands just
as if you were sitting in front of the server console. The technology to make this
happen relies on WinRM 2.0, which is Microsofts latest implementation of the
WS-Management Protocol, a SOAP-based protocol used to manage a variety of
hardware devices. The theory behind this is that it will provide a shared way for
differing systems to communicate with each other.
WinRM 2.0 communicates via HTTP, and so is likely to be firewall-friendly; it also
listens on ports 5985 (default) and 5986 (encrypted), avoiding issues with locally
installed IIS. Even though it uses HTTP for communication, security has still been
considered; either NTLM or Kerberos are used for authentication, and if you wish
to configure WinRM 2.0 to use SSL, that is possible too. A lot of the configuration
can be carried out via new PowerShell cmdlets shipped with version 2.0.
1525
All of the above are installed by default on Windows 7 and Windows Server 2008
R2. However, earlier versions of Windows will require you to download the
updates from Microsoft website and install them yourself.
PowerShell 2.0 and WinRM 2.0 are included as a part of Windows Management
Framework download and are available for Windows XP, Windows Server 2003,
Windows Vista and Windows Server 2008.
To be able run scripts and commands on remote computers, the user performing
remote script execution must be:
l
l
1526
SSL Certificate: This is required if we are going to secure our WinRM connection.
Listener: Inside WinRM, a listener needs to be set up that listens on the network port Windows PowerShell the Remoting Server uses to communicate.
Firewall Exception: A firewall exception is needed that allows outside
requests to reach the WinRM service;
WinRM Service: This service receives requests from other computers and
needs to be running.
1527
1528
3. Select only the SelfSSL.exe tool (if you have no need for the additional
components):
1529
5. Change the current location on SelfSSL install path. Typically the path is
C:\Program Files (x86)\IIS Resources\SelfSSL:
1530
1531
7. Verify that certificate was created properly. Start the Management Console
(MMC.exe):
8. Add the Certificates snap-in and verify that the recently created self-signed
certificate is listed in both the Personal and Trusted Root Certificate
1532
9. Follow the red steps in the graphic, 1 through 4, to select the Certificates:
snap-in
1533
12. Verify that the certificate is in Trusted Root Certificate Authorities storage:
1534
15. Copy the values highlighted above to the clipboard. These copied values
will be used in creating a Listener in the following section.
Create a WinRM HTTPS Listener
Create the Windows Remote Management Listener and bind it to the certificate
using the following steps:
1. Open a Command Prompt as an administrator from the Start menu, (rightclick):
2. The following command should be executed on the Remoting Server computer. This is the target node which will be used with the SAM PowerShell
monitor. It is also the computer where the self-signed certificate was created in the previous section.
1535
For example:
winrm create
winrm/config/Listener?Address=IP:192.168.0.171+Transport=HTTPS @
{Hostname="192.168.0.198";CertificateThumbprint="6aa47ed7356fb0f1e3b4
34850a7bb51ed40b0d3a";Port="5986"}
Once the command has been successfully executed, the output will look similar to
the following illustration:
1536
2. Enter the following command with the parameters replaced with actual values, as explained below:
netsh advfirewall firewall add rule name="<Rule name>" protocol=TCP dir=in localport=<Port number> action=allow
<Rule name> - This is the name of the rule shown in the Windows Firewall under Advanced Security > Inbound Rules;
<Port number> - This is the port number in use for the Listener
that was created in the previous section.
For example:
netsh advfirewall firewall add rule name="WinRM via HTTPS - Open Port
5986" protocol=TCP dir=in localport=5986 action=allow
1537
3. Locate the created certificate and right-click on it then selet All Tasks >
Export
1538
1539
1540
1541
3. Follow the red steps in the graphic, 1 through 4, to select the Certificates
snap-in:
1542
5. Locate Trusted Root Certification Authorities, right click on it, then navigate
to All Tasks > Import.
6. The Certificate Import Wizard will be launched. Find the file to import and
then click Next.
1543
7. Select, Place all Certificates in the following Store. The store is "Trusted
Root Certification Authorities."
1544
1545
4. Turn off the WinRM service and revert the value of the LocalAccountTokenFilterPolicy registry entry:
l PS> Stop-Service WinRM PS> Set-ItemProperty
HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
LocalAccountTokenFilterPolicy 0 -Type DWord
Your client is now able to access other systems remotely using Windows
PowerShell remoting and is no longer limited to Kerberos and machines inside a
domain.
1546
8. Enter a simple script in the monitor for testing by clicking Edit, for example:
write "Statistic.RemoteMachineName: 0";
write "Message.RemoteMachineName: $env:computername";
exit 0;
Note: This script is printing the computer name (the machine on which this
is executed).
1547
1548
11. Create an application based on our template and assign it to the Remoting
Server target node:
12. Examine the script output. Done correctly, you should see the name of the
Remote Server node in the output, not the SAM server, (i.e. the script was
executed remotely).
1549
LDAP
You now have a PowerShell monitor configured to execute scripts remotely via
secure WinRM connection.
LDAP
Lightweight Directory Access Protocol (LDAP) is a protocol for accessing
directory servers. In other words, LDAP is a directory, not a database. There are
no rows or tables in LDAPs directory and there are no relational links. The result
is a simple yet structured directory design that is easy to navigate.
Every object in LDAP can contain one or more sub-objects, much like the folder
and sub-folder relationship used in Windows operating systems. LDAP runs
directly over TCP port 389 by default. It is used to store information about users,
including the network privileges assigned to each user. Revoking or changing
privileges can be done from one entry in the LDAP directory, rather than at many
machines across the network. LDAP also supports SSL and TLS for security.
1550
Example
(givenName=Kate)
Equal to
1551
And
(&(givenNamee=Kate)(l=Austin))
Not
(!givenName=Kate)
Note: Because there
is only one
argument in this
example, it is
surrounded with
parentheses for
illustration.
Wildcard
1552
(title=*)
Wildcard
(givenName=Ka*)
You need a filter to find all objects that are in NYC or Austin, and that have
the first name of "Kate." This would be:
(&(givenName=Kate)(|(l=NYC)(l=Austin)))
You have received 9,360 events in the Application log and you need to
find all of the objects that are causing this logging event. In this case, you
need to find all of the disabled users (msExchUserAccountControl=2)
that do not have a value for msExchMasterAccountSID. This would be:
(&(msExchUserAccountControl=2)(!msExchMasterAccountSID=*))
Note: Using the ! operator with the * operator will look for objects where that
attribute is not set to anything.
1553
l
l
Port Number: Port 389 is the default port for a non-encrypted connection.
Use port 636 if you use encryption.
Encryption Method: Choose either SSL or StartTLS to encrypt your data.
Authentication Method: Below are the five available options:
o Anonymous: Indicates that the connection should be made without
passing credentials.
o Simple: Indicates that basic authentication should be used with the
connection. This only requires a valid username and password.
o NTLM: Indicates that Windows NT Challenge/Response (NTLM)
authentication should be used on the connection. This requires user
name, password, and domain (Realm).
o Kerberos: Indicates that Kerberos authentication should be used on
the connection. This requires a user name, password and domain
(Realm).
1554
This example is based on the Active Directory Domain Controller lab.rio. The
LDAP search root would be CN=Users,DC=lab,DC=rio because the context
name Folder is Users, and the domain DC is lab.rio.
In general, you may specify just the domain root (DC=lab,DC=rio) to begin a
search because the monitor always applies the SearchScope.Subtree request
option. The query will search the entire domain tree for the requested object from
the specified root.
l
LDAP Filter: This describes the search condition for an LDAP query and
matching attributes.
1555
Credentials
Credentials
Credentials should be used without the domain because the Realm field is
defined with this information.
LDAP Monitor Statistics.
The following illustrates typical field entries for a working LDAP User
Experience monitor within SAM:
In the illustration below, the Statistic and the Response Time values are
highlighted. A statistic of 1 is returned indicating that 1 user was found that
matched the filter criteria. This query took 259 milliseconds, as indicated by the
Response Time value of 259.
1556
1557
How To...
This section provides simple examples of how to use the tools and resources that
SAM provides. If you would like to know How To do something or you have an
example of How To accomplish something, please post your idea at: Thwack
Suggestions. If selected, your idea will be listed in this chapter when a new
version of this guide is available.
Following are the examples included:
l
l
l
l
l
l
l
l
l
1558
How To...
For example, clicking the green [+] icon will allow you to add a resource to
that column, which brings up the following screen:
3. From here, you can select a category to group resource items by from the
Group by drop down menu:
Note: The Classic category reflects the tree views found in previous
versions of SAM for this resource.
4. Select the resources you want, and then click Add Selected Resources.
5. Click Done.
Notes:
l
l
1559
3. The following screen appears, allowing you to select one, two, or three
columns. From here you can also select the width of each column in pixels.
For existing nodes, you can disable Asset Inventory data collection by
executing the following SQL command:
UPDATE [SolarWindsOrion].[dbo].[AssetInventory_Polling] set Enabled
= 0;
To disable this for future nodes added, rename the following file:
C:\Program Files (x86)
\SolarWinds\Orion\Discovery\Plugins\SolarWinds.AssetInventory.Disc
overy.plugin
1560
How To...
Where the 5.0 means "if more than 5.0% of the available space is being used by
the data, trigger the alert."
1561
You also may be interested in: How to Monitor an Application Process Launched
from a Specific Path.
1562
How To...
1. Open Notepad and paste the following code into a new document:
Set WshShell = WScript.CreateObject("WScript.Shell")
Dim exeName
Dim statusCode
exeName = "%windir%\notepad"
statusCode = WshShell.Run (exeName, 1, true)
MsgBox("End of Program")
Event happens
Check alerts that match Trigger Condition
Matching alert found, perform Trigger Actions
Perform all applicable Trigger Actions based on action configuration (Escalation falls here)
1563
Files\SolarWinds\JobEngine.v2\plugins\SolarWinds.APM.Probes.plugin
Next, move it to a different location and restart the Job Engine v2
ser-
vice.
Note: This will result in an invalid configuration which may generate
errors.
3. Return the file to its original place and restart the Job Engine v2 service to return this to a working state.
1564
How To...
date. The script below accepts one argument in the form of a URL, with the socket
number, and returns the statistic in the number of days remaining until expiration.
Before using this script you need to install OpenSSL, which is freely available on
the internet. Ensure the path given below has the OpenSSL plug-in installed or
change the path as per your OpenSSL plug-in.
For each instance of the monitor, change the text file that the monitor writes to,
(e.g.: cer1.txt, cer2.txt), otherwise the monitors may return a value of, Unknown.
Warning: The code below is user-submitted. Use at your own risk. SolarWinds is
not responsible for the impact this code may have on your system. Exercise
caution when executing any code with which you are not familiar.
Installation: You will need to pass the argument site name plus the port number.
Example:
www.google.co.uk:443
Code:
Option Explicit
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
Dim
oShell
ArgObj
Fh
FSO
Line
Expiry
DaysLeft
ExpDate
oExec
cert
tstream
i
str
PluginPath
CertFilePath
char
XString
Const ForReading = 1
CertFilePath = "C:\TMP\cert99.txt"
PluginPath = "C:\Program Files\Solarwinds\Common\OpenSSL\bin\"
1565
1566
How To...
'Object Closing code
oExec.Terminate
Set oShell = Nothing
Set oExec = Nothing
'This function converts the date into the required format
Function ConvertDate(DateStr)
Dim Components
Dim Month
Dim Day
Dim Year
Components = Split(DateStr)
Select Case Components(0)
Case "Jan", "January"
Month = 1
Case "Feb", "February"
Month = 2
Case "Mar", "March"
Month = 3
Case "Apr", "April"
Month = 4
Case "May"
Month = 5
Case "Jun", "June"
Month = 6
Case "Jul", "July"
Month = 7
Case "Aug", "August"
Month = 8
Case "Sep", "Sept", "September"
Month = 9
Case "Oct", "October"
Month = 10
Case "Nov", "November"
Month = 11
Case "Dec", "December"
Month = 12
Case Else
Month = 1
End Select
1567
You can set up a Process Monitor (WMI) and SolarWinds SAM will display each
process ID (PID) in the dashboard. However, you need to monitor and report each
separate application that has been launched from each folder. What you want to
be able to do is set up an application template to monitor Data Application 1 that
resides in C:\DataApp1\APP.EXE, then set up another template for data application
2, and so on.
How can you monitor an application that has been launched from each
specific folder/path?
You can use the Command Line filter to get information about concrete instance
(s). Check the command line using Task Manager (it is hidden by default) and if
the command line contains the full path. You can use this as a filter.
1568
How To...
You also may be interested in: How to Monitor Multiple Instances of Sqlservr.exe
1569
Troubleshooting
If you have problems with a SolarWinds product, the causes are usually related to
an incorrect configuration or corrupted files. The suggestions listed in this section
can often clear up these problems.
Additionally, you can visit our knowledge base repository for articles to help
remedy specific issues. The address is: http://knowledgebase.solarwinds.com/kb/
You can also talk to other users as well as the SolarWinds staff by logging on to
thwack.com
Back Up Your Data
As a first step in any troubleshooting procedure, you should back up your Orion
database. For more information, see Creating Database Backups on page1185.
Verify Program Operation
SolarWinds runs many components at the same time to deliver a view of your
network status. Confirm that the following components are running on your
SolarWinds server:
Services:
l
l
l
l
l
l
l
l
l
l
l
l
l
Message Queuing
Net.Tcp Port Sharing Service
SNMP Trap Service
SolarWinds Alerting Engine service
SolarWinds Collector Data Processor, Management Agent, and Polling Controller services
SolarWinds Information Service
SolarWinds Job Engine and Job Engine v2
SolarWinds Job Scheduler
SolarWinds Network Performance Monitor Service. All SolarWinds products
use this service. It is not exclusive to SolarWinds SAM.
SolarWinds Product services
SolarWinds Information Service
SolarWinds Module Engine
SolarWinds Syslog and Trap Services
1570
Troubleshooting
l
l
SQL Server
Internet Information Service (IIS)
1571
5. Close the command prompt window, and then restart your SolarWinds
server.
If these conditions cannot be met, the WMI component monitors in SAM show an
Unknown status. Examples of some issues that can prevent these conditions from
being met include, but are not limited to:
l
l
l
l
Trying to connect to a remote computer where you do not have local Administrator rights.
A firewall blocking the WMI traffic.
An operating system that is not configured for WMI.
Mistyping the credential password in the SAM component monitor.
To help diagnose and fix these issues and others, we can test the WMI services,
the remote WMI connections, and the SolarWinds SAM component configuration
1572
Troubleshooting
to discover and correct the issues that can prevent your WMI component monitors
from functioning correctly.
The topics in this guide are as follows:
l
For more information about moving the SQL Server 2008 temporary directory, tempdb, for see Moving System Databases Example A: Moving
the tempdb Database.
1573
1574
Troubleshooting
1575
1576
Troubleshooting
4. Enter root\cimv2 in the field at the top of the dialog box next to the Connect button.
5. Click Connect.
6. Click Enum Classes.
1577
8. If the WMI class you are querying appears in this list, local WMI services are functioning correctly. Skip to the next topic and test remote WMI.
9. If the list does not appear or does not contain the desired WMI class,
WMI is not functioning correctly. Continue reading this section for guidance
on repairing WMI services on the target server.
10. Click Close, and then click Exit.
1578
Troubleshooting
After resetting the WMI counters, retest WMI. If resetting the WMI counters did not
solve your problem, see WMI is Still Not Working. Now What?
1579
5. Enter the user name in the User field, the password in the Password field,
and NTLMDOMAIN:NameOfDomain in the Authority field. Replace
NameOfDomain with the domain of the user account specified in the User
field.
6. Click Connect.
7. Click Enum Classes.
1580
Troubleshooting
8. Select the Recursive radio button without entering a superclass name,
and then click OK.
9. If the WMI class list appears, remote WMI is functioning correctly. Skip to
the next topic and test your SAM credentials.
10. If the list does not appear, remote WMI is not functioning correctly.
Continue reading this topic for guidance on restoring remote WMI connections on the target server, and retest remote WMI after completing each
troubleshooting step.
11. Click Close, and then click Exit.
1581
Need
l
DCOM
l
l
l
l
l
1582
Troubleshooting
WMI
Namespaces
User
Account
Control
Enabling DCOM
WMI uses DCOM to communicate with monitored target computers. Therefore, for
Server & Application Monitor to use WMI, DCOM must be enabled and properly
configured.
To enable DCOM permissions for your Server & Application Monitor credentials:
1. Log on to the target server with an administrator account.
2. Navigate to Start> Control Panel> Administrative Tools>Component
Services. You need to switch to the Classic View of the Control Panel to
use this navigation path. You can also launch this console by
double-clicking comexp.msc in the /windows/system32 directory.
3. Expand Component Services> Computers.
4. Right-click My Computer, and then select Properties.
5. Select the COM Security tab, and then click Edit Limits in the Access Permissions grouping.
6. Ensure the user account you want to use to collect WMI statistics has
Local Access and Remote Access, and then click OK.
7. Click Edit Default, and then ensure the user account you want to use to
collect WMI statistics has Local Access and Remote Access,
8. Click OK.
9. Click Edit Limits in the Launch and Activation Permissions grouping.
10. Ensure the user account you want to use to collect WMI statistics has
Local Launch, Remote Launch, Local Activation, and Remote Activation, and then click OK.
1583
1584
Troubleshooting
and may result in an unbootable system. Consider backing up your registry before
making these changes.
To disable remote UAC for a workgroup computer:
1.
2.
3.
4.
Polling completion rates are lower than expected which leads to gaps in
data.
Sporadic component monitor timeouts usually resulting in component monitors showing an "Unknown" status, reporting the error, "Connection
timeout. Job cancelled by scheduler."
Resourceexhaustionon the SQL server.
For more information, see "Additional Polling Engine and Web Console" on page
1208.
1585
1586
Troubleshooting
Note: Vista and Windows 2008 have a built-in method for repairing the WMI
repository. Open an Administrator command prompt and run: winmgmt
/salvagerepository
If you are using APM prior to version 4 and using WMI, try the following:
There are three required WMI queries for service monitoring to work:
SELECT * FROM Win32_Service
SELECT * FROM Win32_Process
SELECT * FROM Win32_PerfRawData_PerfProc_Process
You can test these by going to Start > Run > WBEMTEST on the SolarWinds
server.
1.
2.
3.
4.
5.
6.
7.
Click on Connect.
In the whitespace at the top, you should have \\ipaddress\root\CIMV2
For user and password, fill in the credentials used in APM.
For Authority, type in NTLMDOMAIN: and enter your domain.
Click Connect.
Click Query
Enter the above three queries, one at a time.
More often than not, the culprit is the last query. If your problem still exists,
try the following:
1. Re-sync the counters by opening a command prompt and typing: winmgmt
/resyncperf
2. Check to make sure performance counters are not disabled: http://thwack.com/forums/68/application--server-management/21/application-performance-monitor/23124/win32perfrawdataperfprocpro/
Note: WMI is an operating system component. If the previous steps do no
work, you may need to contact Microsoft for further information.
1587
The following systems have been verified to work properly with SAM's hardware
monitoring features.
Note: Other systems may work as well.
l
l
l
Dell PowerEdge M610, R210, R610, R710, R900, 1950, 2850, 2950, 2970,
6850
HP ProLiant DL320 G4, DL360 G3, DL360 G4, DL380 G4, DL380 G6,
ML570 G3
IBM IBM System x3550, System x3550 M2, System x3550 M3, System
x3650, System x3650 M2, System x3650 M3, x3850, eServer 306m
HP C7000, HP C3000
Dell M1000e.
1588
Troubleshooting
SAM. HPs WBEM providers are required for HP servers polled via WMI.
Installation instructions can be at "Monitoring Hardware Health" on page 1076.
1589
1590
Troubleshooting
Note: Dell does not make array and hard disk health information visible from WMI
managed nodes. To monitor storage health on Dell servers, use SNMP.
To determine if the remote server responds to the correct OID, you can use
the MIB browser from SolarWinds Engineers Toolset, which can be downloaded from http://www.solarwinds.com/downloads/. Additionally, you can
use other applications capable of making SNMP requests.
1591
Using SNMPWalk.exe:
If you do not have a tool for checking OIDs on the remote server, you can create
an SNMP walk by using the SNMPWalk.exe installed with SAM, normally located
at C:\Program Files (x86)\SolarWinds\Orion\SnmpWalk.exe. SNMPWalk.exe
will be used in this demonstration.
Using SNMPWalk.exe:
1. Start SNMPWalk.exe and type in the IP address of the remote server and
the community string for SNMP.
2. Click Scan.
3. After completing the scan, save the SNMP walk in a text file.
4. Open the text file and manually search for the OIDs.
If the Remote Server does not respond on this OID, the Hardware Monitoring
Agent software may not be properly configured. Check to see if the Hardware
Monitoring Agent software has imported the correct MIBs as outlined in the
following table.
For information on verifying Hardware Monitoring Agent software, see "Accessing
Hardware Monitoring Agent Software" on page 1078.
HP
Dell
IBM
CPQSTDEQMIB
MIB-Dell-10892
IBM-SYSTEM-HEALTH-MIB
CPQSINFO-
StorageManagement-
IBM-SYSTEM-ASSETID-MIB
1592
Troubleshooting
MIB
MIB
CPQIDA-MIB
IBM-SYSTEM-LMSENSOR-MIB
CPQHLTHMIB
IBM-SYSTEM-MEMORY-MIB
CPQSTSYSMIB
IBM-SYSTEM-POWER-MIB
CPQIDE-MIB
IBM-SYSTEM-PROCESSOR-MIB
IBM-SYSTEM-RAID-MIB
ADAPTEC-UNIVERSALSTORAGE-MIB
1593
6. Click Connect.
7. Once connected, click Query from the main screen. The Query dialog
appears.
1594
Troubleshooting
8. Enter: select * from __Namespace
1595
3. Use the illustration below to determine how your VMWare is being polled.
1596
Troubleshooting
Important: The following log file contains all the information and errors related to
the WinRM configuration process:
C:\ProgramData\Solarwinds\Logs\APM\RunWinRMConfigurator.log
Troubleshooting Permissions
The following information will help you troubleshoot issues with the following:
l
l
l
l
Non-Domain Accounts
Adding Local Administrative privileges to Active Directory Account
Exchange Access
Mailbox Exchange Access
Note: Mailboxes with an empty primary SMTP address can be polled; however,
their Sent and Received statistics will not be not available.
Non-Domain Account
Local accounts (Non-Domain) cannot access Exchange Management interfaces
and therefore are not supported by AppInsight for Exchange. Please select an
Active Directory account or create a new one to use with AppInsight for
Exchange.
Add Local Administrative privileges to Active Directory Account
1. On the server where you want to grant local administrative privileges, open
a Computer Management console.
2. Navigate to System Tools >Local Users and Groups > Groups and then
double click the Administrators group.
3. Click Add and type in the Active Directory username of the account you
want to grant administrative privileges to, and then press Enter. (Ensure the
location is set to either the domain where the account is located or Entire
Directory.)
4. Click Apply and then click OK.
5. Alternatively, you can add an Active Directory group to the Local Administrators group and then add the AD user accounts to that group.
1597
Troubleshooting Permissions
6. To verify the account and local group membership has been configured
properly, run the following in a PowerShell session:
$Recurse = $true
$GroupName = 'Administrators'
Add-Type -AssemblyName System.DirectoryServices.AccountManagement
$ct = [System.DirectoryServices.AccountManagement.ContextType]::Machine
$group = [System.DirectoryServices.AccountManagement.GroupPrincipal]::FindByIdentity
($ct,$GroupName)
$LocalAdmin = $group.GetMembers($Recurse) | select @{N='Domain'; E=
{$_.Context.Name}}, samaccountName, @{N='ObjectType'; E={$_.StructuralObjectClass}} -Unique
$LocalAdmin = $LocalAdmin | Where-Object {$_.ObjectType -eq "user"}
Exchange Access
1598
Troubleshooting
Granting Least Privilege access to the Exchange Organization can be
accomplished using Active Directory Users and Computers (ADUC)
1. From the Start Menu open ADUC and navigate to the Microsoft Exchange
Security Groups OU.
2. Double click on the View-Only Organization Management group.
3. After the window opens, click the Members tab and then click Add.
4. Type the username of the account you want to grant access to the
Exchange organization, and then click OK.
5. Click Apply and then click OK .
6. Close the ADUC window.
Access can also be granted using the Exchange Management
Shell with the following command:
Note: Replace the word "user" with the correct user name of the
service account.
Add-RoleGroupMember -Identity "View-Only Organization
Management" -Member "USER"
or
Get-ManagementRoleAssignment -RoleAssignee USER |
Where-Object {$_.RoleAssigneeName -eq "View-Only
Organization Management" -or $_.RoleAssigneeName -eq
"Organization Management"}
1599
http://technet.microsoft.com/en-us/library/dd876958(v=exchg.150).aspx
http://www.powershellmagazine.com/2013/05/23/pstip-retrieve-group-membership-of-an-active-directory-group-recursively/
Example: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ESE\Performance]
"Close"="ClosePerformanceData"
"Collect"="CollectPerformanceData"
1600
Troubleshooting
"Library"="<Path to performance counter DLL file>"
"Open"="OpenPerformanceData"
"PerfIniFile"="<Name of performance counter INI file>"
Example: "PerfIniFile"="eseperf.ini"
The "Library" file path is typically "C:\Program
Files\Microsoft\Exchange
Server\%ExchangeVersion%\Bin\perf\%Processor_
Architecture%\%DLLFileName%"
Figure 1.
3. Verify the counters have not been disabled by expand the service and then
clicking on the "Performance" key.
4. Check for the value Disable Performance Counters (See Figure 2.) If this
value exists, ensure the data value is 0. Any other value will disable the
counters.
5. Once the value is confirmed to be set to 0, close all PerfMon windows and
then reopen them.
Note: The performance counters should be visible at this time. If the performance counters are not visible, proceed to the next step.
Figure 2.
1601
6. If the values First Counter, First Help, Last Counter, and Last Help are listed (See Figure 3), it is highly recommended to unload the performance
counters prior to reloading them.
Figure 3.
1602
Troubleshooting
a. The default location for Exchange counter definition files is: C:\Program Files\Microsoft\Exchange Server\%ExchangeVersion%\Setup\perf\%XMLFileName%
5. Check the application log to verify the counters were properly loaded and
no PerfLib errors exist. Reopen PerfMon to ensure the counters are available.
Figure 4.
Configuration Errors
Error Message, Information, and Remediation
Error message: Remote configuration was unsuccessful due to the following:
"The deployment service executable was not found on the Orion server." For
details, see the log on the Orion server: ([ALLUSERSPROFILE]
1603
Description: Internal error. The Remote Installation Service.exe file was not
found. (Default file location: C:\Program Files (x86)\SolarWinds\Orion\APM).
This can be caused by an incorrect SAM installation or Remote Installation
Service.exe was deleted or modified.
Remediation: Add the Remote Installation Service.exe file to the following
folder: C:\Program Files (x86)\SolarWinds\Orion\APM.
Remediation:
1604
Troubleshooting
1605
1606
Troubleshooting
SolarWinds.APM.RemoteWinRmConfiguratorFull.exe
1607
Remediation:
l
l
1608
Troubleshooting
1609
Remediation:Add SolarWinds.APM.RemoteWinRmConfiguratorFull.exe.config
to the following location: C:\Program Files (x86)\SolarWinds\Orion\APM.
1610
Troubleshooting
1611
1612
Troubleshooting
2. Click on the Manage menu, and the select Add Roles and
Features.
3. After the wizard opens, click Next until you get to the Installation Type page.
4. Select Role-based or feature-based installation.
5. Click Next until you reach the Features page.
6. Scroll down to Windows PowerShell. It will likely show itself
as partially installed (square inside box).
7. Check the box next to Windows PowerShell 2.0 Engine.
8. Click Next and then Install.
9. When the installation finishes, click Close.
1613
1614
Troubleshooting
1. From the Start Menu, open ADUC and navigate to the Microsoft Exchange
Security Groups OU.
2. Double click on the View-Only Organization Management group.
3. After the window opens, click the Members tab and then click Add.
4. Type the username of the account you want to grant access to the
Exchange organization, and then click OK.
5. Click Apply, and then click OK.
6. Close the ADUC window.
Grant Mailbox Search Access:
Mailbox Search access is required to determine attachment counts and sizes.
This can be granted using the Exchange Management Shell (EMS).
1. From the Start Menu, open the EMS.
2. Type: New-ManagementRoleAssignment -Role "Mailbox Search" -User
<Username of account being granted access> and then press Enter.
3. To verify the management role has been properly assigned, enter the following command:
Get-ManagementRoleAssignment -RoleAssignee <Username of account>
1615
1616
Troubleshooting
1617
1618
Troubleshooting
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
l
1619
1620
Troubleshooting
continue to poll using 32-bit, regardless of this setting.
1621
1622
Troubleshooting
Cause: This is a general error message returned by Windows when a networking
component is malfunctioning.
Resolution: For details, see the log on the Orion server located at:
([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\RemoteExecutableStarter.log). Following
are some of the more common reasons why this error message might be returned
by Windows:
E.G. Restart the remote registry service, check that TCP port 445 is open between
the Orion server and the remotely monitored IIS server.
When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
Node Unreachable.
Error: Credentials test failed. Node is unreachable.
Resolution: Ensure the node is currently being managed. For more information,
see Unmanage Scheduling Utility. When complete, rerun the AppInsight for IIS
Automatic Configuration Wizard.
1623
IISVersion Failed
IISVersion Failed
Error: The current version of IIS is 6.0. Version 7.0 or higher is required.
Resolution: Install IIS version 7.0 or higher. When complete, rerun the AppInsight
for IIS Automatic Configuration Wizard.
1624
Troubleshooting
1625
4. Ensure that the group to which the polling user belongs has access to
Microsoft PowerShell.
1626
Troubleshooting
5. Click OK.
Error Code 1367
Error: Incorrect user name and/or password.
Resolution: Enter a valid user name and password combination. When
complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
1627
1628
Troubleshooting
1629
1630
Troubleshooting
Error Code 16005
Error: The configuration executable was not found on the Orion server.
Cause: The SolarWinds.APM.RemoteIISConfigurator.exe file was not found.
This can be caused by an incorrect SAM installation or the
SolarWinds.APM.RemoteIISConfigurator.exe file was deleted or modified.
Resolution: Add the SolarWinds.APM.RemoteIISConfigurator.exe file to the
following directory: C:\Program Files (x86)\SolarWinds\Orion\APM. For details,
see the log on the Orion server located at: ([ALLUSERSPROFILE]
\ProgramData\Solarwinds\Logs\APM\RemoteExecutableStarter.log). When
complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
1631
1632
Troubleshooting
Cause: The configuration executable cannot be started on the remote IIS server
due to one or more of the following:
l
l
l
Resolution: Try to lower the User Account Control settings on remote IIS server.
Also check that the user account has privileges to run executable files. When
complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
1633
are some of the more common reasons why this error message might be returned
by Windows:
l
1634
Troubleshooting
1635
1636
Troubleshooting
5. When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
&
RemoteIISConfiguratorPowerShell.log). For configuring WinRM using a
different port, see An HTTPS listener currently exists on port 5986:
\ProgramData\Solarwinds\Logs\APM\RemoteIISConfigurator.log
1637
1638
Troubleshooting
1639
1640
Troubleshooting
4. Right-click the Windows Remote Management (WS-Management) service, and then click Start
5. When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
1641
1642
Troubleshooting
1643
Other Errors
7. Check the box next to Windows PowerShell 2.0 Engine.
8. Click Next and then Install.
9. When the installation finishes, click Close.
Other Errors
Issue:PowerShell 2.0 is not Installed
Resolution: Install PowerShell.
Installing PowerShell 2.0 on Server 2008:
For Server 2008, download the installation file for PowerShell 2.0 at
http://support.microsoft.com/kb/968929/en-us and install it on the
server.
Note: PowerShell 2.0 is automatically installed on Server 2008 R2
and therefore no additional installation is required.
Installing PowerShell 2.0 on Server 2012:
1. Open Server Manager.
2. Click on the Manage menu, and the select Add Roles and
Features.
3. After the wizard opens, click Next until you get to the Installation
Type page.
4. Select Role-based or feature-based installation.
5. Click Next until you reach the Features page.
6. Scroll down to Windows PowerShell. It will likely show itself as
partially installed (square inside box).
7. Check the box next to Windows PowerShell 2.0 Engine.
8. Click Next and then Install.
9. When the installation finishes, click Close.
Setting the appropriate permissions for PowerShell on the target
server:
1. On the remote computer, open the PowerShell console.
2. Execute the following PowerShell command: Set-PSSessionConfiguration Microsoft.PowerShell -ShowSecurityDescriptorUI -force
appear.)
3. Uncheck the Deny check box to enable the Full Control option
under the Permissions for Everyone group.
1644
Troubleshooting
4. Ensure that the group to which the polling user belongs has
access to Microsoft PowerShell.
1645
Other Errors
5. Click OK.
6. When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
Issue: PowerShell WebAdministration snapin is not installed.
Information: For legacy systems with IIS 7.0 (Windows Vista, Windows 2008)
PowerShell WebAdministration snapins are not part of IIS.
Resolution: Download and install the PowerShell WebAdministration snapins
found at the following link: http://www.iis.net/downloads/microsoft/powershell
When complete, rerun the AppInsight for IIS Automatic Configuration Wizard.
1646
Troubleshooting
1647
where the NewValue will be the desired memory limit. If the error persists,
the value should be increased again.
An HTTPS listener currently exists on port 5986:
Important: If you received the following error: An HTTPS listener currently exists
on port 5986, use the following steps to configure the listener on an available port
by changing 5986 to an available port number throughout these steps.
1. To configure WinRM on a server, open a command prompt in the Run as
Administrator context.
2. Type: winrm create winrm/config/listener?Address=*+Transport=HTTPS
@{Port="5986";CertificateThumbprint="<Thumbprint value of certificate>";Hostname="<IP Address of Server>_Solarwinds_IIS_Zero_Configuration"}
1648
Troubleshooting
3. Run the function to create the firewall exception for WSMAN using the
following command:
Add-FirewallRule "Windows Remote Management" "5986" $null
1649
Event IDs
$null
Event IDs
The matrix below outlines and defines Microsoft event IDs to help aid in
troubleshooting:
Event ID
Source
Log
Severity Message
2281
1650
Troubleshooting
WMSVC
2297
5039
Microsoft- System
WindowsWAS
Warning
5015
Microsoft- System
WindowsWAS
Warning
5127
Microsoft- System
WindowsWAS
Warning
1173
Microsoft- System
WindowsIISW3SVC
Error
1026
Microsoft- System
WindowsIISW3SVC
Warning
1135,
1134
Microsoft- System
WindowsIISWMSVC
Warning
1020
Microsoft- System
Windows-
Warning
1651
Event IDs
IISWMSVC
1062
Microsoft- System
WindowsIISWMSVC
Warning
1126
Microsoft- System
WindowsIISW3SVC
Warning
1175
Microsoft- System
WindowsIISW3SVC
Warning
1071,
1073
Microsoft- System
WindowsIISW3SVC
Warning
1087
Microsoft- System
WindowsIISW3SVC
Warning
1086
Microsoft- System
WindowsIISW3SVC
Warning
5067
Microsoft- System
WindowsWAS
Warning
1037
Microsoft- System
Windows-
Warning
1652
Troubleshooting
IISW3SVC
2208
2206
2201
2203
2204
2274,
2268,
2220,
2219,
2214
5088,
5061,
5060
Microsoft- System
WindowsWAS
2227
Warning
1653
Event IDs
IISWMSVC
connection
2233
2226,
2230,
2231,
2232
5174,
5179,
5180
Microsoft- System
WindowsWAS
Warning
5085
Microsoft- System
WindowsWAS
Warning
5054,
5091
Microsoft- System
WindowsWAS
Error
5063
Microsoft- System
WindowsWAS
Warning
5058
Microsoft- System
WindowsWAS
Warning
1654
Troubleshooting
5066
Microsoft- System
WindowsWAS
Error
5153
Microsoft- System
WindowsWAS
Warning
5172,
5173
Microsoft- System
WindowsWAS
Warning
5014
Microsoft- System
WindowsWAS
Warning
5101
Microsoft- System
WindowsWAS
Error
5070,
5093
Microsoft- System
WindowsWAS
Warning
5005
Microsoft- System
WindowsWAS
Error
5053
Microsoft- System
WindowsWAS
Warning
2296
Microsoft-
Application Warning
1655
Event IDs
WindowsIISW3SVCWP
precondition
2295
2293
1133
Microsoft- System
WindowsIISW3SVC
Warning
2261
SF_NOTIFY_READ_RAW_
DATA filter notification is not
supported in IIS
5036
Microsoft- System
WindowsWAS
2264
2298
Error
1656
Troubleshooting
W3SVCWP
2218
2258
5152
Microsoft- System
WindowsWAS
Warning
5010,
5011,
5012,
5013
Microsoft- System
WindowsWAS
Warning
5009
Microsoft- System
WindowsWAS
Warning
2216
2221
2222
1657
Event IDs
IISW3SVCWP
Error
5030
Microsoft- System
WindowsWAS
2279,
2278,
2277
1005
MicrosoftWindowsIISW3SVC
8001
MicrosoftWindowsIISWMSVC
1658
Troubleshooting
Troubleshooting Agents
Troubleshooting Deployment via Orion Server Push:
Following is a list of possible errors with their respective resolutions:
l
1659
1660